Medium severity · published Feb 5, 2025
CVE-2024-7595
GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network…
6.5
CVSS
1.6%
EPSS
No
On KEV
Description
GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors.
This can be considered similar to CVE-2020-10136.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Generic Routing Encapsulation · Ietf
All versions, or not specified · source: NVD
GR
Generic Routing Encapsulation6 · Ietf
All versions, or not specified · source: NVD