Vulnerabilities in Tunneling Protocols Expose Millions of Internet Hosts
2025-01-21
Learn how to secure cloud environments and network infrastructure from tunneling protocol vulnerabilities to protect against anonymous attacks and unauthorized network access.
Recent research has identified security vulnerabilities in several tunneling protocols that affect approximately 4.2 million internet hosts, including VPN servers and routers. These vulnerabilities arise from the lack of sender verification, allowing attackers to perform anonymous attacks and access networks by exploiting protocols such as IP6IP6, GRE6, 4in6, and 6in4 without proper authentication and encryption. The affected hosts, particularly in countries like China, France, Japan, the U.S., and Brazil, could be misused for creating one-way proxies and conducting denial-of-service attacks. Mitigation strategies include using IPSec or WireGuard for security, accepting packets only from trusted sources, implementing traffic filtering, deep packet inspection, and blocking unencrypted tunneling packets.
Misconfiguration, Shadow IT/Exposed Assets, Other: Inadequate Authentication
Tunneling Protocols, VPN Vulnerabilities, GRE, IP6IP6, DDoS Attacks, Network Security
CVE-2020-10136; CVE-2024-7595; CVE-2024-7596; CVE-2025-23018; CVE-2025-23019
VPN servers, ISP home routers, core internet routers, mobile network gateways, content delivery network (CDN) nodes
New research has uncovered significant security vulnerabilities in several tunneling protocols, affecting approximately 4.2 million internet hosts globally. These vulnerabilities are found in various systems, including VPN servers, ISP home routers, core internet routers, mobile network gateways, and content delivery network (CDN) nodes. Countries most impacted include China, France, Japan, the U.S., and Brazil. The vulnerabilities stem from tunneling protocols like IP6IP6, GRE6, 4in6, and 6in4, which are used to transfer data between disconnected networks. These protocols lack proper authentication and encryption when not coupled with robust security measures like Internet Protocol Security (IPsec). Without these safeguards, the protocols are open to abuse, allowing attackers to inject malicious traffic, conduct denial-of-service (DoS) attacks, and create one-way proxies. The attack involves sending a packet encapsulated with two IP headers. The outer header contains the attacker's source IP and the vulnerable host's IP as the destination. The inner header, however, shows the source IP as the vulnerable host and the destination as the attack target. When the vulnerable system receives this packet, it strips the outer header and forwards the inner packet, bypassing network filters due to the trusted source IP. Exploitation of these vulnerabilities could enable attackers to perform anonymous attacks and gain unauthorized access to networks. This can lead to significant security breaches, allowing adversaries to use affected systems for malicious activities. To mitigate these risks, it is advised to implement the following security measures: By adopting these strategies, organizations can better protect their networks and reduce the risk posed by these vulnerabilities. The affected tunneling protocols have been assigned the following CVE identifiers: Addressing these vulnerabilities is crucial for maintaining the security and integrity of network infrastructures.Security Flaws in Tunneling Protocols Threaten Millions of Internet Hosts
Overview
The Vulnerabilities
Attack Methodology
Potential Impact
Mitigation Recommendations
CVE Identifiers
https://thehackernews.com/2025/01/unsecured-tunneling-protocols-expose-42.html?m=1