PT-2025-1236 · Ietf · Proposed Generic Udp Encapsulation

Published 2025-01-15 · Updated 2025-02-06 · CVE-2024-7596

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Proposed Generic UDP Encapsulation (GUE) (IETF Draft) (affected versions not specified)

Description The issue concerns the lack of validation or verification of the source of a network packet in the Proposed Generic UDP Encapsulation (GUE) (IETF Draft), allowing an attacker to spoof and route arbitrary traffic via an exposed network interface. This can lead to spoofing, access control bypass, and other unexpected network behaviors. The vulnerability can be exploited by a remote attacker to implement attacks by sending a specially crafted packet with two IP headers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-940

Related Identifiers

BDU:2025-00616

CVE-2024-7596

Affected Products

Proposed Generic Udp Encapsulation

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-7596 · Security Note
• https://bdu.fstec.ru/vul/2025-00616 · Security Note
• https://t.me/true_secator/6628 · Telegram Post
• https://top10vpn.com/research/tunneling-protocol-vulnerability/#attack-details · Note
• https://twitter.com/VulmonFeeds/status/1887301665616810111 · Twitter Post
• https://securityonline.info/new-tunneling-protocol-vulnerabilities-expose-4-2-million-hosts-to-cyberattacks · Note
• https://twitter.com/CVEnew/status/1887197089454588047 · Twitter Post
• https://rfc-editor.org/rfc/rfc6169.html · Note
• https://thehackernews.com/2025/01/unsecured-tunneling-protocols-expose-42.html · Note
• https://kb.cert.org/vuls/id/199397 · Note
• https://twitter.com/SEI_CMU/status/1882147898290577469 · Twitter Post
• https://datatracker.ietf.org/doc/draft-ietf-intarea-gue · Note