{"id":"CVE-2020-10136","aliases":["EUVD-2020-2599","GHSA-8gxc-83hw-9578"],"status":"published","title":"IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic","description":"IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.28537,"percentile":0.98145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-290"],"published":"2020-06-02T08:35:12Z","modified":"2026-06-17T02:47:25Z","exploits":[{"source":"pocgithub","id":"PapayaJackal/ipeeyoupeewepee","title":"PapayaJackal/ipeeyoupeewepee","date":"2025-01-21","url":"https://github.com/PapayaJackal/ipeeyoupeewepee"}],"products":[{"vendor":"cisco","product":"nx-os"},{"vendor":"cisco","product":"ucs_manager"},{"vendor":"cisco","product":"unified_computing_system"},{"vendor":"digi","product":"saros"},{"vendor":"hp","product":"x3220nr_firmware"},{"vendor":"ietf","product":"rfc2003 - ip encapsulation within ip"},{"vendor":"treck","product":"tcp\\/ip"}],"references":[{"url":"https://kb.cert.org/vuls/id/636397/","tags":["x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.digi.com/resources/security","tags":["x_transferred","Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/636397","tags":["x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://datatracker.ietf.org/doc/html/rfc6169","tags":["x_transferred"]},{"url":"https://www.kb.cert.org/vuls/id/199397"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10136"},{"url":"https://kb.cert.org/vuls/id/636397"},{"url":"https://github.com/advisories/GHSA-8gxc-83hw-9578"}],"sources":{"cve":[{"id":"CVE-2020-10136","title":"IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic","description":"IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.","status":"published","published":"2020-06-02T08:35:12.921Z","modified":"2025-11-03T20:33:32.981Z","cwes":["CWE-290"],"updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2020-2599","description":"IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.","status":"published","published":"2020-06-02T08:35:12Z","modified":"2025-11-03T20:33:32Z","updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-8gxc-83hw-9578","title":"Multiple products that implement the IP Encapsulation within IP standard (RFC 2003, STD 1)...","description":"Multiple products that implement the IP Encapsulation within IP standard (RFC 2003, STD 1) decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface and lead to spoofing, access control bypass, and other unexpected network behaviors.","status":"published","published":"2022-05-24T17:18:58Z","modified":"2025-11-03T21:31:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2020-10136","description":"IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.","status":"published","published":"2020-06-02T09:15:09.967Z","modified":"2026-06-17T02:47:25.47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:06:04.922138Z"}]}}