Vulnerability Report

CVE-2020-10136

Title: IP-in-IP protocol Spoofing/Access-Control Bypass

Access Control Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2020-10136.

CWE Category CWE-290

Published Date Jun 02, 2020

Modified Date Nov 03, 2025

Exploit Status Not Found

Score 5.3 CVSS v3.1

Exploit Probability (EPSS)

15.08%

Vulnerability Summary

CVE-2020-10136: IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

Impacted Vendors

hp 1

treck 1

cisco 59

Reference Links

https://datatracker.ietf.org/doc/html/rfc6169 https://kb.cert.org/vuls/id/636397/ https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4 https://www.digi.com/resources/security https://www.kb.cert.org/vuls/id/636397 https://datatracker.ietf.org/doc/html/rfc6169 https://kb.cert.org/vuls/id/636397/ https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4 https://www.digi.com/resources/security https://www.kb.cert.org/vuls/id/199397 https://www.kb.cert.org/vuls/id/636397

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2020-10136 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

November 03, 2025 MODIFIED

Vulnerability data or affected products updated.

June 02, 2020 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Stack

No specific products linked.