4 ms·
The cert alert seems to imply this is a general vulnerability, but really it mostly seems to be a default misconfiguration enabling IP-in-IP on a few products.
by mhandley 6y ago
The cert alert seems to imply this is a general vulnerability, but really it mostly seems to be a default misconfiguration enabling IP-in-IP on a few products. I just modified the PoC and did a scan of my home network, which has a pretty broad range of random consumer gear. Nothing decapsulated the scan packets. So while there are clearly some affected products and they clearly need patching, it doesn't seem all that widespread.
- vesinisa 6y ago"A few products"? Looks like the whole Cisco Nexus series of data center switches is vulnerable in their default configuration. https://www.cisco.com/c/en/us/products/switches/data-center-switches/index.html https://www.cisco.com/c/en/us/products/switches/data-center-... That's a whole lot of high-end switches in high-sensitivity environment. Cisco advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4 https://tools.cisco.com/security/center/content/CiscoSecurit...