Vulnerability · Published Jun 2, 2020 · Assigned by certcc
CVE-2020-10136IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic
Medium 5.3
In plain English
A medium-severity authentication bypass by spoofing in RFC2003 - IP Encapsulation within IP from IETF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 28.5% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)28.5%top 1.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IETF | RFC2003 - IP Encapsulation within IP | STD 1 |
Weakness: CWE-290