CVE-2020-10136

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
IETF	RFC2003 - IP Encapsulation within IP	STD 1

References

https://datatracker.ietf.org/doc/html/rfc6169
https://kb.cert.org/vuls/id/636397/Third Party Advisory, US Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4Vendor Advisory
https://www.digi.com/resources/securityThird Party Advisory
https://www.kb.cert.org/vuls/id/636397Third Party Advisory, US Government Resource
https://datatracker.ietf.org/doc/html/rfc6169
https://kb.cert.org/vuls/id/636397/Third Party Advisory, US Government Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4Vendor Advisory
https://www.digi.com/resources/securityThird Party Advisory
https://www.kb.cert.org/vuls/id/199397
https://www.kb.cert.org/vuls/id/636397Third Party Advisory, US Government Resource

Timeline

Published: Jun 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-101376.5Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allow CVE-2020-101387.8Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C CVE-2020-101397.8Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acro CVE-2020-10147.8An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Micr CVE-2020-101407.3Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed f CVE-2020-101437.8Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged se CVE-2020-101457.8The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2 CVE-2020-101465.4The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited o CVE-2020-101489.8The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerab CVE-2020-10157.8An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in memory, aka 'Windows El CVE-2020-10165.5An information disclosure vulnerability exists when the Windows Push Notification Service improperly handles objects in memory, aka 'Windows CVE-2020-10177.8An elevation of privilege vulnerability exists in the way the Windows Push Notification Service handles objects in memory, aka 'Windows Push