L2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.7%
exploitation probability
0.7%top 52% of all CVEs
observed exploitation
nono source reports it
In short
Network devices can be tricked into allowing blocked traffic by using special frame combinations with VLAN 0 headers and format conversions between Ethernet and WiFi. This bypasses security filters meant to prevent dangerous network messages.
Technical detail
Layer 2 filtering mechanisms (e.g., IPv6 RA guard) can be circumvented by crafting frames with stacked VLAN 0 tags, LLC/SNAP encapsulation, and exploiting Ethernet-to-WiFi frame translation asymmetries. The attack requires network access to transmit crafted frames and affects devices relying on L2-based security policies.
Summary generated and translated by AI from the official description.
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N