IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

Project Subscriptions

Vendors Products
Nexus 1000v Subscribe
Nexus 1000ve Subscribe
Nexus 3016 Subscribe
Nexus 3048 Subscribe
Nexus 3064 Subscribe
Nexus 3064-t Subscribe
Nexus 3132q Subscribe
Nexus 3172 Subscribe
Nexus 5010 Subscribe
Nexus 5020 Subscribe
Nexus 5548p Subscribe
Nexus 5548up Subscribe
Nexus 5596t Subscribe
Nexus 5596up Subscribe
Nexus 56128p Subscribe
Nexus 5624q Subscribe
Nexus 5648q Subscribe
Nexus 5672up Subscribe
Nexus 5696q Subscribe
Nexus 6001 Subscribe
Nexus 6004 Subscribe
Nexus 7000 Subscribe
Nexus 7700 Subscribe
Nexus 92304qc Subscribe
Nexus 92348gc-x Subscribe
Nexus 9236c Subscribe
Nexus 9272q Subscribe
Nexus 93108tc-ex Subscribe
Nexus 93108tc-fx Subscribe
Nexus 93120tx Subscribe
Nexus 93128tx Subscribe
Nexus 93180lc-ex Subscribe
Nexus 93180yc-ex Subscribe
Nexus 93180yc-fx Subscribe
Nexus 93216tc-fx2 Subscribe
Nexus 93240yc-fx2 Subscribe
Nexus 9332c Subscribe
Nexus 9332pq Subscribe
Nexus 93360yc-fx2 Subscribe
Nexus 9336c-fx2 Subscribe
Nexus 9336pq Aci Spine Subscribe
Nexus 9348gc-fxp Subscribe
Nexus 9364c Subscribe
Nexus 9372px Subscribe
Nexus 9372px-e Subscribe
Nexus 9372tx Subscribe
Nexus 9372tx-e Subscribe
Nexus 9396px Subscribe
Nexus 9396tx Subscribe
Nexus 9504 Subscribe
Nexus 9508 Subscribe
Nexus 9516 Subscribe
Ucs 6248up Subscribe
Ucs 6296up Subscribe
Ucs 6324 Subscribe
Ucs 6332 Subscribe
Ucs 6332-16up Subscribe
Ucs Manager Subscribe
Unified Computing System Subscribe
X3220nr Firmware Subscribe
Tcp\/ip Subscribe
Advisories

No advisories yet.

Fixes

Solution

Customers should apply the latest patch provided by the affected vendor that addresses this issue and prevents unspecified IP-in-IP packets from being processed. Devices manufacturers are urged to disable IP-in-IP in their default configuration and require their customers to explicitly configure IP-in-IP as and when needed.


Workaround

Users can block IP-in-IP packets by filtering IP protocol number 4. Note this filtering is for the IPv4 Protocol (or IPv6 Next Header) field value of 4 and not IP protocol version 4 (IPv4).

History

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2025-11-03T20:33:32.981Z

Reserved: 2020-03-05T00:00:00.000Z

Link: CVE-2020-10136

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-06-02T09:15:09.967

Modified: 2025-11-03T21:15:39.860

Link: CVE-2020-10136

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-06-09T14:00:00Z

Links: CVE-2020-10136 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses