CVE-2024-7596

Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered similar to CVE-2020-10136.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://datatracker.ietf.org/doc/draft-ietf-intarea-gue/	Technical Description Related
https://www.rfc-editor.org/rfc/rfc6169.html	Technical Description Related
https://www.kb.cert.org/vuls/id/199397

Configurations

Configuration 1 (hide)

cpe:2.3:a:ietf:generic_udp_encapsulation:-:*:*:*:*:*:*:*

History

03 Nov 2025, 21:18

Type	Values Removed	Values Added
References		() https://www.kb.cert.org/vuls/id/199397 -

Information

Published : 2025-02-05 18:15

Updated : 2025-11-03 21:18

NVD link : CVE-2024-7596

Mitre link : CVE-2024-7596

CVE.ORG link : CVE-2024-7596

JSON object : View

Products Affected

ietf

generic_udp_encapsulation

CWE

NVD-CWE-Other

{"id": "CVE-2024-7596", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-02-05T18:15:29.470", "references": [{"url": "https://datatracker.ietf.org/doc/draft-ietf-intarea-gue/", "tags": ["Technical Description", "Related"], "source": "[email protected]"}, {"url": "https://www.rfc-editor.org/rfc/rfc6169.html", "tags": ["Technical Description", "Related"], "source": "[email protected]"}, {"url": "https://www.kb.cert.org/vuls/id/199397", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors.\r\n\r\nThis can be considered similar to CVE-2020-10136."}, {"lang": "es", "value": "Proposed Generic UDP Encapsulation (GUE) (IETF Draft) no valida ni verifica el origen de un paquete de red, lo que permite que un atacante falsifique y enrute tr\u00e1fico arbitrario a trav\u00e9s de una interfaz de red expuesta, lo que puede provocar suplantaci\u00f3n de identidad, omisi\u00f3n del control de acceso y otros comportamientos de red inesperados. Esto puede considerarse similar a CVE-2020-10136."}], "lastModified": "2025-11-03T21:18:48.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ietf:generic_udp_encapsulation:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F21F2CB-F6FF-47F1-ABEF-0AA0D883B8C1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}