CVE-2020-10136

IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic

MEDIUM

5.3

CVSS Score

Published: June 2, 2020 at 08:35 AM UTC

Updated: June 17, 2026 at 02:47 AM UTC

64 products affected across 5 vendorsNx OSUnified Computing SystemTCP /ip

Using RFC2003 - IP Encapsulation within IP by IETF?

Get instant alerts when new vulnerabilities affect RFC2003 - IP Encapsulation within IP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 29%

Description

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Nx OS · Cisconpm

95%

5.0(3)a1(1)5.0(3)a1(2)5.0(3)a1(2a)5.0(3)u1(1)5.0(3)u1(1a)5.0(3)u1(1b)5.0(3)u1(1c)5.0(3)u1(1d)5.0(3)u1(2)5.0(3)u1(2a)5.0(3)u2(1)5.0(3)u2(2)5.0(3)u2(2a)5.0(3)u2(2b)5.0(3)u2(2c)5.0(3)u2(2d)5.0(3)u3(1)5.0(3)u3(2)5.0(3)u3(2a)5.0(3)u3(2b)5.0(3)u4(1)5.0(3)u5(1)5.0(3)u5(1a)5.0(3)u5(1b)5.0(3)u5(1c)5.0(3)u5(1d)5.0(3)u5(1e)5.0(3)u5(1f)5.0(3)u5(1g)5.0(3)u5(1h)5.0(3)u5(1i)5.0(3)u5(1j)5.2(1)5.2(1)n1(1)5.2(1)n1(1a)5.2(1)n1(1b)5.2(1)n1(2)5.2(1)n1(2a)5.2(1)n1(3)5.2(1)n1(4)5.2(1)n1(5)5.2(1)n1(6)5.2(1)n1(7)5.2(1)n1(8)5.2(1)n1(8a)5.2(1)n1(8b)5.2(1)n1(9)5.2(1)n1(9a)5.2(1)n1(9b)5.2(1)sk3(1.1)5.2(1)sk3(2.1)5.2(1)sk3(2.1a)5.2(1)sk3(2.2)5.2(1)sk3(2.2b)5.2(1)sm1(5.1)5.2(1)sm1(5.2)5.2(1)sm1(5.2a)5.2(1)sm1(5.2b)5.2(1)sm1(5.2c)5.2(1)sm3(1.1)5.2(1)sm3(1.1a)5.2(1)sm3(1.1b)5.2(1)sm3(1.1c)5.2(1)sm3(2.1)5.2(1)sv3(1.1)5.2(1)sv3(1.10)5.2(1)sv3(1.15)5.2(1)sv3(1.2)5.2(1)sv3(1.3)5.2(1)sv3(1.4)5.2(1)sv3(1.4b)5.2(1)sv3(1.5a)5.2(1)sv3(1.5b)5.2(1)sv3(1.6)5.2(1)sv3(2.1)5.2(1)sv3(2.5)5.2(1)sv3(2.8)5.2(1)sv3(3.1)5.2(1)sv3(3.15)5.2(1)sv3(4.1)5.2(1)sv3(4.1a)5.2(1)sv3(4.1b)5.2(1)sv5(1.1)5.2(1)sv5(1.2)5.2(1)sv5(1.3)5.2(3)5.2(3a)5.2(4)5.2(5)5.2(7)5.2(9)5.2(9a)6.0(2)a1(1)6.0(2)a1(1a)6.0(2)a1(1b)6.0(2)a1(1c)6.0(2)a1(1d)6.0(2)a1(1e)6.0(2)a1(1f)6.0(2)a1(2d)6.0(2)a3(1)6.0(2)a3(2)6.0(2)a3(4)6.0(2)a4(1)6.0(2)a4(2)6.0(2)a4(3)6.0(2)a4(4)6.0(2)a4(5)6.0(2)a4(6)6.0(2)n1(1)6.0(2)n1(1a)6.0(2)n1(2)6.0(2)n1(2a)6.0(2)n2(1)6.0(2)n2(1b)6.0(2)n2(2)6.0(2)n2(3)6.0(2)n2(4)6.0(2)n2(5)6.0(2)n2(5a)6.0(2)n2(5b)6.0(2)n2(6)6.0(2)n2(7)6.0(2)u1(1)6.0(2)u1(1a)6.0(2)u1(2)6.0(2)u1(3)6.0(2)u1(4)6.0(2)u2(1)6.0(2)u2(2)6.0(2)u2(3)6.0(2)u2(4)6.0(2)u2(4.92.4z)6.0(2)u2(5)6.0(2)u2(6)6.0(2)u3(1)6.0(2)u3(2)6.0(2)u3(3)6.0(2)u3(4)6.0(2)u3(5)6.0(2)u3(6)6.0(2)u3(7)6.0(2)u3(8)6.0(2)u3(9)6.0(2)u4(1)6.0(2)u4(2)6.0(2)u4(3)6.0(2)u4(4)6.0(2)u5(1)6.1(2)i1(2)6.1(2)i1(3)6.1(2)i2(1)6.1(2)i2(2)6.1(2)i2(2a)6.1(2)i2(2b)6.1(2)i2(3)6.1(2)i3(1)6.1(2)i3(2)6.1(2)i3(3)6.1(2)i3(3a)6.2(10)6.2(12)6.2(14)6.2(14a)6.2(14b)6.2(16)6.2(18)6.2(2)6.2(20)6.2(20a)6.2(22)6.2(24)6.2(2a)6.2(6)6.2(6a)6.2(6b)6.2(8)6.2(8a)6.2(8b)7.0(0)n1(1)7.0(1)n1(1)7.0(2)n1(1)7.0(3)i1(1)7.0(3)i1(1a)7.0(3)i1(1b)7.0(3)i1(1z)7.0(3)n1(1)7.0(4)n1(1)7.0(4)n1(1a)7.0(5)n1(1)7.0(5)n1(1a)7.0(6)n1(1)7.0(6)n1(2s)7.0(6)n1(3s)7.0(6)n1(4s)7.0(7)n1(1)7.0(7)n1(1a)7.0(7)n1(1b)7.0(8)n1(1)7.0(8)n1(1a)7.1(0)n1(1)7.1(0)n1(1a)7.1(0)n1(1b)7.1(1)n1(1)7.1(1)n1(1a)7.1(2)n1(1)7.1(2)n1(1a)7.1(3)n1(1)7.1(3)n1(2)7.1(3)n1(2a)7.1(3)n1(3)7.1(3)n1(4)7.1(3)n1(5)7.1(4)n1(1)7.1(4)n1(1a)7.1(4)n1(1c)7.1(4)n1(1d)7.1(5)n1(1)7.1(5)n1(1b)7.2(0)d1(1)7.2(1)d1(1)7.2(1)n1(1)7.2(2)d1(1)7.2(2)d1(2)7.2(2)d1(3)7.2(2)d1(4)7.3(0)d1(1)7.3(0)dx(1)7.3(0)n1(1)7.3(0)n1(1a)7.3(0)n1(1b)7.3(1)d1(1)7.3(1)n1(1)7.3(2)d1(1)7.3(2)d1(1d)7.3(2)d1(2)7.3(2)d1(3)7.3(2)d1(3a)7.3(2)n1(1)7.3(2)n1(1b)7.3(2)n1(1c)7.3(3)d1(1)7.3(3)n1(1)7.3(4)d1(1)7.3(4)n1(1)7.3(4)n1(1a)7.3(5)d1(1)7.3(5)n1(1)7.3(6)d1(1)7.3(6)n1(1)7.3(6)n1(1a)7.3(7)n1(1)7.3(7)n1(1a)

cisco-nexus-1000v (environment) · cisco-nexus-1000ve (environment) · cisco-nexus-3016 (environment) · cisco-nexus-3048 (environment) · cisco-nexus-3064 (environment) · cisco-nexus-3064-t (environment) · cisco-nexus-3132q (environment) · cisco-nexus-3172 (environment) · cisco-nexus-5010 (environment) · cisco-nexus-5020 (environment) · cisco-nexus-5548p (environment) · cisco-nexus-5548up (environment) · cisco-nexus-5596t (environment) · cisco-nexus-5596up (environment) · cisco-nexus-56128p (environment) · cisco-nexus-5624q (environment) · cisco-nexus-5648q (environment) · cisco-nexus-5672up (environment) · cisco-nexus-5696q (environment) · cisco-nexus-6001 (environment) · cisco-nexus-6004 (environment) · cisco-nexus-7000 (environment) · cisco-nexus-7700 (environment) · cisco-nexus-92304qc (environment) · cisco-nexus-92348gc-x (environment) · cisco-nexus-9236c (environment) · cisco-nexus-9272q (environment) · cisco-nexus-93108tc-ex (environment) · cisco-nexus-93108tc-fx (environment) · cisco-nexus-93120tx (environment) · cisco-nexus-93128tx (environment) · cisco-nexus-93180lc-ex (environment) · cisco-nexus-93180yc-ex (environment) · cisco-nexus-93180yc-fx (environment) · cisco-nexus-93216tc-fx2 (environment) · cisco-nexus-93240yc-fx2 (environment) · cisco-nexus-9332c (environment) · cisco-nexus-9332pq (environment) · cisco-nexus-93360yc-fx2 (environment) · cisco-nexus-9336c-fx2 (environment) · cisco-nexus-9336pq-aci-spine (environment) · cisco-nexus-9348gc-fxp (environment) · cisco-nexus-9364c (environment) · cisco-nexus-9372px (environment) · cisco-nexus-9372px-e (environment) · cisco-nexus-9372tx (environment) · cisco-nexus-9372tx-e (environment) · cisco-nexus-9396px (environment) · cisco-nexus-9396tx (environment) · cisco-nexus-9504 (environment) · cisco-nexus-9508 (environment) · cisco-nexus-9516 (environment)

Ucs Manager · Cisco

95%

3.2(3n)a

cisco-ucs-6248up (environment) · cisco-ucs-6296up (environment) · cisco-ucs-6324 (environment) · cisco-ucs-6332 (environment) · cisco-ucs-6332-16up (environment)

Unified Computing System · Cisco

95%

All versions

Saros · Digi

95%

v < 8.1.0.1

Affected range stops below 8.1.0.1, so it looks safe — our inference, not a vendor statement

X3220NR Firmware · HP

95%

v < 3.00.11.08

Affected range stops below 3.00.11.08, so it looks safe — our inference, not a vendor statement

TCP /ip · Treck