CVE-2020-10136 IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic
Remote attackers can bypass access controls and route arbitrary traffic by exploiting IP-in-IP encapsulation flaws, affecting systems with this protocol enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10136?
CVE-2020-10136 is a medium-severity vulnerability in Cisco Nx-Os, published on 2 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.
Weakness: CWE-290
Which versions are affected by CVE-2020-10136?
It affects 6 products.
Products include Cisco Nx-Os, Cisco Ucs Manager, Cisco Unified Computing System, Digi Saros, Hp X3220nr Firmware, Treck Tcp\/Ip.
How do I fix CVE-2020-10136?
No fix has been published for CVE-2020-10136 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10136 being exploited?
There is no known exploitation of CVE-2020-10136 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Cisco Nx-Os
Sources
Also known as GHSA-8gxc-83hw-9578.