Skip to contentArista Networks vulnerabilities
Newest
- arista ng firewall, arista networks edge threat management +1 moreA user with administrator privileges can perform command injectionCVE-2024-91317.2 High
- arista networks cloudvision applianceOn Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This re…CVE-2024-71424.6 Medium
- arista networks eosOn affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as rou…CVE-2024-58726.5 Medium
- arista networks eosOn affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak…CVE-2024-70954.3 Medium
- arista networks eos - bgp flowspec, eos - interface traffic policy, eos-policy based routing (pbr) +2 moreOn affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- ce…CVE-2024-64375.8 Medium
- arista networks wireless access points, arista wireless access point firmware +1 morePrivilege escalation in Arista Wireless Access PointsCVE-2024-45788.4 High
- arista multiaccess, arista networks mos +1 moreOn affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in som…CVE-2023-60683.1 Low
- arista ng firewall, arista networks edge threat management - arista ng firewall (ngfw) +1 moreMultiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).CVE-2024-278898.8 High
- arista mosOn Arista MOS configuration of a BGP password will cause the password to be logged in clear text.CVE-2023-245475.9 Medium
- arista eosOn affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.CVE-2023-36465.9 Medium
- arista eosOn affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward pac…CVE-2023-245485.3 Medium
- arista cloudvision portal, arista networks cloudvision +1 moreOn affected versions of the CloudVision Portal improper access controls on the connection from...CVE-2023-245468.1 High
- arista eosOn the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.CVE-2023-245107.5 High
- arista eos, arista networks terminattr, arista ceos-lab +2 more +4 moreOn affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.CVE-2023-245128.8 High
- arista eosOn affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login…CVE-2023-245099.3 Critical
- arista cloudeos, arista networks eos +1 moreOn affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch.CVE-2023-245457.5 High
- arista cloudeos, arista networks eos +1 moreOn affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options…CVE-2023-245136.5 Medium
- arista eosOn affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.CVE-2023-245115.3 Medium
- arista networks eosAll versions of Econolite EOS traffic control software are vulnerable to CWE-328: Use of Weak...CVE-2023-04529.8 Critical
- arista networks eosAll versions of Econolite EOS traffic control software are vulnerable to CWE-284: Improper Access...CVE-2023-04517.5 High
- arista eosFor certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of…CVE-2021-285105.3 Medium
- arista eosThis advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if…CVE-2021-285115.8 Medium
- arista cloudvision portalThis advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked i…CVE-2022-290714.0 Medium
- arista eos, terminattr +1 moreTerminAttr streams MACsec sensitive data in clear text to other authorized users in CVPCVE-2021-285096.1 Medium
- arista eos, terminattr +1 moreTerminAttr streams IPsec sensitive data in clear text to other authorized users in CVPCVE-2021-285086.8 Medium
- arista eosOn affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access…CVE-2021-285057.5 High
- arista eosOn Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declar…CVE-2021-285047.5 High
- arista eosIn Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.CVE-2021-285037.4 High
- arista eosAn issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users…CVE-2021-285009.1 Critical
- arista eosAn issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the deni…CVE-2021-285075.5 Medium
- arista eosAn issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.CVE-2021-285069.1 Critical
- arista terminattrAn issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users…CVE-2021-285019.1 Critical
- arista eosIn Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the devi…CVE-2021-284965.7 Medium