Vulnerability Description
IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Nx-Os | 5.2\(1\)sk3\(1.1\) |
| Cisco | Nexus 1000V | - |
| Cisco | Nexus 1000Ve | - |
| Cisco | Nexus 3016 | - |
| Cisco | Nexus 3048 | - |
| Cisco | Nexus 3064 | - |
| Cisco | Nexus 3064-T | - |
| Cisco | Nexus 3132Q | - |
| Cisco | Nexus 3172 | - |
| Cisco | Nexus 5010 | - |
| Cisco | Nexus 5020 | - |
| Cisco | Nexus 5548P | - |
| Cisco | Nexus 5548Up | - |
| Cisco | Nexus 5596T | - |
| Cisco | Nexus 5596Up | - |
| Cisco | Nexus 56128P | - |
| Cisco | Nexus 5624Q | - |
| Cisco | Nexus 5648Q | - |
| Cisco | Nexus 5672Up | - |
| Cisco | Nexus 5696Q | - |
Related Weaknesses (CWE)
References
- https://datatracker.ietf.org/doc/html/rfc6169
- https://kb.cert.org/vuls/id/636397/Third Party AdvisoryUS Government Resource
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nVendor Advisory
- https://www.digi.com/resources/securityThird Party Advisory
- https://www.kb.cert.org/vuls/id/636397Third Party AdvisoryUS Government Resource
- https://datatracker.ietf.org/doc/html/rfc6169
- https://kb.cert.org/vuls/id/636397/Third Party AdvisoryUS Government Resource
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nVendor Advisory
- https://www.digi.com/resources/securityThird Party Advisory
- https://www.kb.cert.org/vuls/id/199397
- https://www.kb.cert.org/vuls/id/636397Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2020-10136?
CVE-2020-10136 is a vulnerability with a CVSS score of 5.3 (MEDIUM). IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected beha...
How severe is CVE-2020-10136?
CVE-2020-10136 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10136?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Nx-Os, Cisco Nexus 1000V, Cisco Nexus 1000Ve, Cisco Nexus 3016, Cisco Nexus 3048.