CVE-2024-7596: generic udp (CVSS 6.5)

Description

Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered similar to CVE-2020-10136.

Is your site exposed to CVE-2024-7596?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Affected Products

Vendor	Product	Versions
ietf	generic_udp_encapsulation	All

References

Other References

https://datatracker.ietf.org/doc/draft-ietf-intarea-gue/ https://www.rfc-editor.org/rfc/rfc6169.html https://www.kb.cert.org/vuls/id/199397

Frequently Asked Questions

What is CVE-2024-7596? +

Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered similar to CVE-2020-10136. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-7596? +

CVE-2024-7596 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-7596? +

CVE-2024-7596 affects products from ietf, specifically: generic_udp_encapsulation. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-7596? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-7595 6.5

GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to …

CVE-2025-23018 5.4

IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, …

CVE-2025-23019 5.4

IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface.

CVE-2024-7596