CVE-2025-23018 — Improper Verification of Source of a Communication Channel in Ipv6

CWE-940 — Improper Verification of Source of a Communication Channel CWE-348 — Use of Less Trusted Source4 documents4 sources

Severity

6.5MEDIUMNVD

CNA5.3

EPSS

0.1%

top 81.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Ietf Ipv6

Timeline

PublishedJan 14

Description

IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an exposed network interface. This is a similar issue to CVE-2020-10136.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LExploitability: 2.2 | Impact: 3.7

Affected Packages1 packages

▶CVEListV5ietf/ipv66

🔴Vulnerability Details

GHSA

GHSA-mf23-wm84-g9x3: IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attack↗2025-01-14

▶

CVEList

CVE-2025-23018: IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attack↗2025-01-14

▶

📋Vendor Advisories

Red Hat

networkmanager: 4in6 and 6in6 protocols excessive trust↗2025-01-14

▶