Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Microsoft Teredo may let outsiders reach internal servers

CVE-2006-6264 · published 19 years ago
Summary

Microsoft's Teredo service can mistakenly trust any incoming Teredo address, even if it looks like an internal network address. This can allow an attacker to send IPv4 traffic past normal network filters and reach devices inside your private network. Apply the latest Microsoft updates or disable Teredo if you do not need it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft teredo All versions
cpe:2.3:a:microsoft:teredo:*:*:*:*:*:*:*:*
Original advisory text
Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address, which might allow remote attackers to send IPv4 traffic to...
Teredo creates trusted peer entries for arbitrary incoming source Teredo addresses, even if the low 32 bits represent an intranet address, which might allow remote attackers to send IPv4 traffic to intranet hosts that use non-RFC1918 addresses, bypassing IPv4 ingress filtering.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
15% chance of attack within 30 days
Timeline
Published4 Dec 2006
Updated1 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-6264 · NVD
Track software like this
Free during beta