CVE-2025-23018 describes a vulnerability in IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) within IETF IPv6 implementations, allowing attackers to spoof and route arbitrary traffic due to a lack of source validation. This medium-severity vulnerability (CVSS 6.5) has a network attack vector with high attack complexity, potentially leading to low impacts on confidentiality, integrity, and availability. While not currently in CISA's KEV catalog and lacking public exploit code, it has garnered some community discussion and media attention, indicating awareness of the issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:ietf:ipv6:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.