Microsoft Teredo vulnerabilities

4 CVEs affecting Microsoft Teredo, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2006-6266, published 2006-12-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2006-6264, published 2006-12-04. High severity, CVSS 7.5. EPSS: 14.3% chance of exploitation in the next 30 days. Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address, which might allow remote attackers to send IPv4 traffic to…
CVE-2006-6263, published 2006-12-04. Medium severity, CVSS 6.8. EPSS: 12.5% chance of exploitation in the next 30 days. Teredo clients, when source routing is enabled, recognize a Routing header in an encapsulated IPv6 packet and send the packet to the next hop, which might allow remote attackers to bypass policies of…
CVE-2006-6266, published 2006-12-04. Medium severity, CVSS 6.8. EPSS: 11.8% chance of exploitation in the next 30 days. Teredo clients, when following item 6 of RFC4380 section 5.2.3, start direct IPv6 connectivity tests (aka ping tests) in response to packets from non-Teredo source addresses, which might allow remote…
CVE-2006-6265, published 2006-12-04. Medium severity, CVSS 5.8. EPSS: 4.5% chance of exploitation in the next 30 days. Teredo clients, when located behind a restricted NAT, allow remote attackers to establish an inbound connection without the guessing required to find a port mapping for a traditional restricted NAT…