K44453423: IP-in-IP Packet Processing vulnerability CVE-2020-10136

Security Advisory Description Multiple products that implement the IP Encapsulation within IP standard RFC 2003, STD 1 decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface an...

CVE-2020-10136

CVE-2020-10136 concerns the IP Encapsulation within IP (IPIP) decapsulation path that decapsulates and routes IP-in-IP traffic without validation of the source network packets, enabling spoofing and potential access-control bypass and other unexpected behavior. The NVD entry assigns a MEDIUM seve...

IP-in-IP protocol routes arbitrary traffic by default

Overview IP Encapsulation within IP RFC2003 IP-in-IP can be abused by an unauthenticated attacker to unexpectedly route arbitrary network traffic through a vulnerable device. Description IP-in-IP encapsulation is a tunneling protocol specified in RFC 2003 that allows for IP packets to be...