CVE-2025-23018

6.5 mediumEPSS 1.0%

Medium (6.5) in ietf ipv6. EPSS 1.0% chance of exploitation in the next 30 days.

IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an exposed network interface. This is a similar issue to CVE-2020-10136.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-940
Published: 2025-01-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ietf:ipv6

References

https://datatracker.ietf.org/doc/html/rfc2473
https://papers.mathyvanhoef.com/usenix2025-tunnels.pdf
https://www.top10vpn.com/research/tunneling-protocol-vulnerability/
https://www.kb.cert.org/vuls/id/199397

Check your stack JSON