CVE-2020-10136

—

CVSS 3.1

5.3 medium

EPSS

29%p98

Published

Jun 2, 2020 (Jun 2, 2020)

Modified

Jun 17, 2026

Description

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

Vendors: cisco digi hp treck
Products: nx-os, ucs manager, saros, x3220nr firmware, tcp\/ip, unified computing system
Weakness: CWE-290
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

NVD CVE.org GitHub PoCs EPSS (28.5%)

In the news2 stories

IP-in-IP flaw affects devices from Cisco and other vendors

Security AffairsJun 2, 15:30 UTC · Jun 2, 2020Exploit / PoC CVE-2020-10136

Unsecured Tunneling Protocols Expose 4.2 Million Hosts, Including VPNs and Routers

The Hacker NewsJul 20, 07:23 UTC · Jul 20, 2025Vulnerability CVE-2020-10136 CVE-2024-7595 CVE-2024-7596+2 CVEs