> when a tunnel interface is manually configured on the device using tunnel mode ipip and appropriate tunnel source and tunnel destination. The device is not expected to decapsulate and process any IP in IP traffic that is not destined to such a tunnel interface.

> This vulnerability causes an affected device to unexpectedly decapsulate and process IP in IP packets that are destined to a locally configured IP address, even when no tunnel configuration is present. Any input ACL configured on an inbound interface of the affected device is evaluated against the IP fields on the carrier IP packet prior to decapsulation; it would not be evaluated on the passenger IP packet.

> Under specific conditions, processing of a crafted IP in IP packet could cause the network stack process to crash on an affected device.

Ummmmm.... This sounds embarrasingly bad for Cisco. The crash DoS is just a cherry on top. But failing to filter tunneled packets is bit of a wtf, especially if you don't even have tunneling configured.

And despite this being marked as generic vuln, the gist really seem to be just squarely a Cisco implementation fault.