CVE detail

CVE-2020-10136 — CVE-2020-10136

Published 2020-06-02 · Modified 2026-06-17 · Vendor cisco · Product nx-os · Source nvd

MEDIUM

severity

CVSS-derived band

5.3

CVSS v3

0–10 scale

0.2854

EPSS probability

exploitation probability, 30d

98.0%

EPSS percentile

percentile vs all CVEs

NOT LISTED

CISA KEV

known exploited catalog

Description

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

Remediation

vendor remediation guidance

Customers should apply the latest patch provided by the affected vendor that addresses this issue and prevents unspecified IP-in-IP packets from being processed. Devices manufacturers are urged to disable IP-in-IP in their default configuration and require their customers to explicitly configure IP-in-IP as and when needed.

workarounds

Users can block IP-in-IP packets by filtering IP protocol number 4. Note this filtering is for the IPv4 Protocol (or IPv6 Next Header) field value of 4 and not IP protocol version 4 (IPv4).

Product	Vulnerable range	Fixed version	Advisory
IETF RFC2003 - IP Encapsulation within IP	—	not specified	advisory ↗

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.