Arista vulnerabilities

Products

• Eos 46
• Ng Firewall 20
• Cloudvision Portal 10
• C-65 Firmware 8
• C-75 Firmware 8
• O-90 Firmware 8
• W-68 Firmware 8
• Eos 7
• C-200 Firmware 7
• C-230 Firmware 7
• C-235 Firmware 7
• C-250 Firmware 7
• C-260 Firmware 7
• C-100 Firmware 6
• C-110 Firmware 6
• C-120 Firmware 6
• C-130 Firmware 6
• Metamako Operating System 6
• Metamako Operating System 6
• O-105 Firmware 6
• W-118 Firmware 6
• Ng Firewall 5
• Velocloud Orchestrator 5
• Cloudeos 4
• Terminattr 4
• Velocloud Orchestrator 3
• Mos 2

Newest

• arista velocloud orchestrator Security Advisory 0199 CVE-2026-114625 In KEVPublic exploit 9.4 CriticalOctober 22, 2026
• arista velocloud orchestrator, arista networks velocloud orchestrator (vco) on-prem +1 more Security Advisory 0183 CVE-2026-93952 In KEV 9.5 CriticalSeptember 22, 2026
• arista velocloud orchestrator, arista networks velocloud orchestrator on-prem +1 more VeloCloud Orchestrator OS Command Injection CVE-2026-16812 In KEV 10.0 CriticalJuly 27, 2026
• arista networks edge threat management - arista next generation firewall (ngfw), arista ng firewall +1 more Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting CVE-2026-25624 5.8 MediumJune 5, 2026
• arista networks edge threat management - arista next generation firewall (ngfw), arista ng firewall +1 more Arista Edge Threat Management NGFW UI Arbitrary Command Execution CVE-2026-25623 7.0 HighJune 5, 2026
• arista networks edge threat management - arista next generation firewall (ngfw), arista ng firewall +1 more Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection CVE-2026-25622 7.0 HighJune 5, 2026
• arista networks edge threat management - arista next generation firewall (ngfw), arista ng firewall +1 more Arista Edge Threat Management NGFW Reports Application Insecure Input Validation CVE-2026-25621 7.0 HighJune 5, 2026
• arista networks edge threat management - arista next generation firewall (ngfw), arista ng firewall +1 more Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection CVE-2026-25620 7.0 HighJune 5, 2026
• arista eos, extensible operating system +1 more Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass CVE-2026-7473 In KEVPublic exploit 6.9 MediumJune 5, 2026
• amazon linux, linux kernel, arista cloudvision agni +142 more +144 more crypto: algif_aead - Revert to operating out-of-place CVE-2026-31431 In KEVPublic exploitFix available EPSS 98.1% 7.8 HighApril 22, 2026
• arista ng firewall Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability CVE-2025-2767 8.8 HighApril 23, 2025
• arista ng firewall, arista networks edge threat management +1 more Specially constructed queries cause cross platform scripting leaking administrator tokens CVE-2024-9188 8.8 HighJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more A user with advanced report application access rights can perform actions for which they are not authorized CVE-2024-47520 7.6 HighJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more Backup uploads to ETM subject to man-in-the-middle interception CVE-2024-47519 8.3 HighJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more Specially constructed queries targeting ETM could discover active remote access sessions CVE-2024-47518 6.4 MediumJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access CVE-2024-47517 6.8 MediumJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on th… CVE-2024-9134 8.3 HighJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more A user with administrator privileges is able to retrieve authentication tokens CVE-2024-9133 6.6 MediumJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more The administrator is able to configure an insecure captive portal script CVE-2024-9132 8.1 HighJanuary 10, 2025
• arista ng firewall, arista networks edge threat management +1 more A user with administrator privileges can perform command injection CVE-2024-9131 7.2 HighJanuary 10, 2025
• arista ng firewall Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability CVE-2024-12831 6.6 MediumDecember 20, 2024
• arista ng firewall Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability CVE-2024-12832 8.3 HighDecember 20, 2024
• arista ng firewall Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability CVE-2024-12830 8.1 HighDecember 20, 2024
• arista ng firewall Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability CVE-2024-12829 7.2 HighDecember 20, 2024
• openbsd openssh, almalinux, amazon linux +71 more +73 more Openssh: regresshion - race condition in ssh allows rce/dos CVE-2024-6387 Public exploitFix available EPSS 99.5% 8.1 HighJuly 1, 2024
• arista networks wireless access points, arista wireless access point firmware +1 more Privilege escalation in Arista Wireless Access Points CVE-2024-4578 8.4 HighJune 27, 2024
• arista multiaccess, arista networks mos +1 more On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in som… CVE-2023-6068 3.1 LowMarch 4, 2024
• arista ng firewall, arista networks edge threat management - arista ng firewall (ngfw) +1 more Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). CVE-2024-27889 8.8 HighMarch 4, 2024
• arista mos On Arista MOS configuration of a BGP password will cause the password to be logged in clear text. CVE-2023-24547 5.9 MediumDecember 5, 2023
• arista eos On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload. CVE-2023-3646 5.9 MediumAugust 29, 2023
• arista eos On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward pac… CVE-2023-24548 5.3 MediumAugust 29, 2023
• arista cloudvision portal, arista networks cloudvision +1 more On affected versions of the CloudVision Portal improper access controls on the connection from... CVE-2023-24546 8.1 HighJune 13, 2023
• arista eos On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart. CVE-2023-24510 7.5 HighJune 5, 2023
• arista eos, arista networks terminattr, arista ceos-lab +2 more +4 more On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. CVE-2023-24512 8.8 HighApril 25, 2023
• arista eos On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login… CVE-2023-24509 9.3 CriticalApril 13, 2023
• arista cloudeos, arista networks eos +1 more On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. CVE-2023-24545 7.5 HighApril 12, 2023
• arista cloudeos, arista networks eos +1 more On affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options… CVE-2023-24513 6.5 MediumApril 12, 2023
• arista eos On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. CVE-2023-24511 5.3 MediumApril 12, 2023
• arista eos For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of… CVE-2021-28510 5.3 MediumJanuary 24, 2023
• arista eos This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if… CVE-2021-28511 5.8 MediumAugust 5, 2022
• arista cloudvision portal This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked i… CVE-2022-29071 4.0 MediumAugust 5, 2022
• arista eos, terminattr +1 more TerminAttr streams MACsec sensitive data in clear text to other authorized users in CVP CVE-2021-28509 6.1 MediumMay 26, 2022
• arista eos, terminattr +1 more TerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP CVE-2021-28508 6.8 MediumMay 26, 2022
• arista eos On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access… CVE-2021-28505 7.5 HighApril 14, 2022
• arista eos On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declar… CVE-2021-28504 7.5 HighApril 1, 2022
• arista eos In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI. CVE-2021-28503 7.4 HighFebruary 4, 2022
• arista eos An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users… CVE-2021-28500 9.1 CriticalJanuary 14, 2022
• arista eos An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the deni… CVE-2021-28507 5.5 MediumJanuary 14, 2022
• arista eos An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device. CVE-2021-28506 9.1 CriticalJanuary 14, 2022
• arista terminattr An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users… CVE-2021-28501 9.1 CriticalJanuary 14, 2022
• Show olderLoading…