CVE-2020-10136

CVE-2020-10136 is a medium-severity vulnerability affecting the IP-in-IP protocol implementation in products from vendors like Cisco, Digi, HP, and Treck. It stems from a lack of validation before decapsulating and routing IP-in-IP traffic, leading to potential spoofing, access-control bypass, and other unexpected behaviors. The vulnerability has a CVSS score of 5.3 (MEDIUM) and an EPSS score indicating it is more likely to be exploited than 94.5% of all CVEs. The attack vector is network-based with low attack complexity, requiring no user interaction or privileges. While the impact is limited to availability (A:L), the FAUCET Risk Score of 90/100 suggests a significant concern. Currently, there is no evidence of active exploitation (KEV: No), and no public exploit code is available on platforms like Metasploit or ExploitDB. However, the vulnerability has garnered some community attention with mentions on Reddit and media coverage from SecurityWeek.