ID

VAR-202006-0258

CVE

CVE-2020-10136

TITLE

IP-in-IP protocol routes arbitrary traffic by default

DESCRIPTION

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing. IP-in-IP encapsulation is a tunneling protocol specified in RFC 2003 that allows for IP packets to be encapsulated inside another IP packets. This is very similar to IPSEC VPNs in tunnel mode, except in the case of IP-in-IP, the traffic is unencrypted. An IP-in-IP device is considered to be vulnerable if it accepts IP-in-IP packets from any source to any destination without explicit configuration between the specified source and destination IP addresses. This unexpected Data Processing Error (CWE-19) by a vulnerable device can be abused to perform reflective DDoS and in certain scenarios used to bypass network access control lists. Because the forwarded network packet may not be inspected or verified by vulnerable devices, there are possibly other unexpected behaviors that can be abused by an attacker on the target device or the target device's network environment. An unauthenticated attacker can route network traffic through a vulnerable device, which may lead to reflective DDoS, information leak and bypass of network access controls. Tunnelling protocols are an essential part of the Internet and form much of the backbone that modern network infrastructure relies on today. One limitation of these protocols is that they do not authenticate and/or encrypt traffic. Though this limitation exists, IPsec can be implemented to help prevent attacks. However, implementation of these protocols have been executed poorly in some areas.CVE-2020-10136 Affected Vendor Statement: Cisco has fixed products affected by this CVE in its default configuration and released a security advisory for it at the time of the original disclosure in 2020. Please refer to VU#636397 and to the security advisory link in the References section. References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4 CVE-2024-7595 Not Affected CVE-2024-7596 Not Affected CVE-2025-23018 Not Affected CVE-2025-23019 Not AffectedCVE-2020-10136 Affected Vendor Statement: Cisco has fixed products affected by this CVE in its default configuration and released a security advisory for it at the time of the original disclosure in 2020. Please refer to VU#636397 and to the security advisory link in the References section. References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4 CVE-2024-7595 Not Affected CVE-2024-7596 Not Affected CVE-2025-23018 Not Affected CVE-2025-23019 Not Affected. Cisco NX-OS Software is a data center-level operating system software used by a set of switches of Cisco. A code issue vulnerability exists in Cisco NX-OS Software due to the program decapsulating and processing the IP in an IP packet destined for a locally configured IP address. A remote attacker can exploit this vulnerability to bypass the access control list or cause a denial of service by means of a specially crafted IP in the IP packet. The following products and versions are affected: Nexus 1000 Virtual Edge for VMware vSphere; Nexus 1000V Switch for Microsoft Hyper-V; Nexus 1000V Switch for VMware vSphere; Nexus 3000 Series Switches; Nexus 5500 Platform Switches; Nexus 5600 Platform Switches; Nexus 6000 Switches ; Nexus 7000 Series Switches; Nexus 9000 Series Switches in standalone NX-OS mode; UCS 6200 Series Fabric Interconnects; UCS 6300 Series Fabric Interconnects

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

code problem

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Thanks to Yannay Livneh for reporting this issue to us. This document was written by Vijay Sarvepalli.

SOURCES

LAST UPDATE DATE

2025-01-24T22:46:52.858000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE