Description (CNA)
IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an exposed network interface. This is a similar issue to CVE-2020-10136.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| IETF / IPv6 | affected 6 |
CWE
CWE-940
References
- https://datatracker.ietf.org/doc/html/rfc2473
- https://papers.mathyvanhoef.com/usenix2025-tunnels.pdf
- https://www.top10vpn.com/research/tunneling-protocol-vulnerability/
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.