CVE-2020-10136 - CVE House

Back to Database

Status published Medium CVE-2020-10136

IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic

5.3 CVSS

Vulnerability Description

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10136

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thanks to Yannay Livneh for reporting this issue.

References

More from IETF

View All →

In certain IETF OAuth 2.0-related specifications, when the JSON Web...

IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and...

IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the...

Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet

GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet

Affected Vendor

IETF

View all reports →

Affected Software

RFC2003 - IP Encapsulation within IP

Vulnerable Versions:

STD 1

Timeline

Official Publish: June 2nd, 2020

Last Modified: November 3rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1190 Exploit Public-Facing Application