IP-in-IP Packet Processing Vulnerability Affects Multiple Devices

Summary

A vulnerability identified as CVE-2020-10136 , has been discovered in the IP-in-IP tunneling protocol, also known as IPencap. The flaw is a result of a data processing error in which an affected device does not properly inspect and verify forwarded packets. Exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass network access controls (NACs) and route traffic through vulnerable devices which may result in a reflected distributed denial-of-service (DDoS) or information leakage. Affected devices include products from various vendors such as Cisco, Digi International, HP, and Treck.

Recommendations

The NJCCIC recommends users of affected devices apply patches as they are made available. Additionally, we recommend users disable IP-in-IP in all interfaces that do not require this feature. Further information can be found in the CERT Coordination Center advisory.