Medium severity · published Feb 5, 2025
CVE-2024-7596
Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an…
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors.
This can be considered similar to CVE-2020-10136.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GU
Generic Udp Encapsulation · Ietf
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7596
Technical Description
https://datatracker.ietf.org/doc/draft-ietf-intarea-gue/
Technical Description
https://www.rfc-editor.org/rfc/rfc6169.html
www.kb.cert.org
https://www.kb.cert.org/vuls/id/199397