CVE-2024-7596: draft-ietf-intarea-gue-09 · Authentication Bypass by Spoofing
Affects draft-ietf-intarea-gue-09Source CVE Database V5
Mentioned vulnerabilities
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 58% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 5 Feb 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Implement strict source validation and filtering on network interfaces that support GUE encapsulation to block spoofed packets.
- Employ network segmentation and isolation to limit exposure of interfaces running GUE-09 to trusted devices only.
- Monitor network traffic for anomalies indicative of spoofing or unauthorized routing, using IDS/IPS solutions tuned for UDP encapsulation patterns.
- Avoid deploying draft-ietf-intarea-gue-09 in production environments until the vulnerability is addressed in a finalized protocol version.
- Collaborate with network equipment vendors and IETF working groups to track updates or patches addressing this issue.
- Use cryptographic authentication or integrity protection mechanisms where possible to validate packet sources in encapsulation protocols.
- Conduct regular security assessments and penetration tests focusing on network protocol implementations to detect similar weaknesses.
Description
Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered similar to CVE-2020-10136.