- Description
- GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered similar to CVE-2020-10136.
- Source
- cret@cert.org
- NVD status
- Modified
CVSS 3.1
- Type
- Primary
- Base score
- 6.5
- Impact score
- 3.7
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
- Severity
- MEDIUM
- Hype score
- Not currently trending
CVE-2024-7595 GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed netwo… https://t.co/homipVmiNa
@CVEnew
5 Feb 2025
142 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
#exploit 1. CVE-2020-10136, CVE-2024-7595: Scanner and attack suite for hosts that forward unauthenticated packets via IPIP/GRE protocols https://t.co/YgHt6lJMRS 2. CVE-2024-55591: FortiOS/FortiProxy Authentication bypass in Node.js websocket module https://t.co/jxxDS2K6SD 3.…
@ksg93rd
27 Jan 2025
61 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ICYMI—the SEI's CERT Division released a vulnerability note: insecure implementation of tunneling protocols (GRE/IPIP/4in6/6in4). (CVE-2020-10136, CVE-2024-7595, CVE-2024-7596, CVE-2025-23018, and CVE-2025-23019) https://t.co/yKpfXOEaVX https://t.co/onq3OwwNde
@SEI_CMU
22 Jan 2025
151 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ietf:generic_routing_encapsulation:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B962BEC9-66A8-4A0B-AE6D-9A1A7E34686E"
},
{
"criteria": "cpe:2.3:a:ietf:generic_routing_encapsulation6:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4726FA71-5F65-4746-B9F9-6205569B019F"
}
],
"operator": "OR"
}
]
}
]