IP-in-IP packet processing, a protocol used for tunneling by numerous vendors, contains a vulnerability that may lead to DDoS, information leakage and bypass of network access controls.

CVE-2020-10136: IP-in-IP Packet Processing Vulnerability Could Lead to DDoS, Network Access Bypass and Information Disclosure

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA100061 advisory.

  - IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network     interface. (CVE-2025-23019)

  - IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the     source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an exposed     network interface. This is a similar issue to CVE-2020-10136. (CVE-2025-23018)

  - GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an     attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing,     access control bypass, and other unexpected network behaviors. This can be considered similar to     CVE-2020-10136. (CVE-2024-7595)

  - IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and     route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due     to the lack of validation to verify network packets before decapsulation and routing. (CVE-2020-10136)

  - An insecure configuration flaw was found in the GRE and GRE6 Protocols. When configured to not require     authentication or filtering, this issue could allow a remote unauthenticated attacker to spoof packets or     bypass access controls. (CVE-2024-7595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple products that implement the IP Encapsulation within IP standard (RFC 2003, STD 1) decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface and lead to spoofing, access control bypass, and other unexpected network behaviors.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, the Cisco NX-OS Software is affected by a denial of service vulnerability in the network stack due to the affected device unexpectedly decapsulating and processing IP in IP packets that are destined to a locally configured IP address. An unauthenticated, remote attacker can exploit this issue by sending a crafted IP in IP packet to an affected device, to bypass certain security boundaries or cause a denial of service condition on an affected device.

ID	Name	Product	Family	Severity
242166	Juniper Junos OS Multiple Vulnerabilities (JSA100061)	Nessus	Junos Local Security Checks	medium
501351	Cisco NX-OS Software Unexpected IP in IP Packet Processing (CVE-2020-10136)	Tenable OT Security	Tenable.ot	medium
137184	Cisco NX-OS Software Unexpected IP in IP Packet Processing Vulnerability (cisco-sa-nxos-ipip-dos-kCT9X4)	Nessus	CISCO	medium

Detections

Analytics

CVE-2020-10136

medium

Tenable Plugins

medium

medium

medium