CVE-2020-10136
MediumPublished
IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic
- Published
- Jun 2, 2020
- Updated
- Nov 3, 2025
- Assigning CNA
- certcc
- Evidence observed
- Aug 5, 2026
Primary CVSS
5.3/ 10Medium
IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LModerate · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.
Scanner and attack suite for hosts that forward unauthenticated packets via IPIP and GRE protocols. (CVE-2020-10136 CVE-2024-7595)
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.