Latest vulnerabilities for "arista eos"

Arista EOSOn affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption o

Risk 26

Severity

5.3

First published (updated )

CVE-2025-7048

Arista EOSA specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted

Risk 29

Severity

7.1

EPSS

0.02%

First published (updated )

CVE-2025-8872

Arista EOSOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.

Risk 23

Severity

5.6

EPSS

0.03%

First published (updated )

CVE-2025-8870

Arista EOSn affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.

Risk 15

Severity

2.6

First published (updated )

CVE-2025-2826

Arista EOSOn affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal

Risk 27

Severity

5.3

First published (updated )

CVE-2025-2796

Arista EOSOn affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries.

Risk 40

Severity

6.5

First published (updated )

CVE-2024-11185

Arista EOSOn affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropp

Risk 43

Severity

7.5

First published (updated )

CVE-2024-9448

Arista EOSOn affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

Risk 66

Severity

9.1

First published (updated )

CVE-2024-12378

Arista EOSOn affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly

Risk 38

Severity

6.5

First published (updated )

CVE-2025-0936

Arista EOSOn affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar

Risk 32

Severity

5.3

First published (updated )

CVE-2024-8000

Arista EOSOn affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping.

Risk 27

Severity

5.3

First published (updated )

CVE-2024-9135

Arista EOSOn affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.

Risk 72

Severity

9.1

First published (updated )

CVE-2025-1260

Arista EOSOn affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.

Risk 44

Severity

7.7

First published (updated )

CVE-2025-1259

Arista EOSOn affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.

Risk 40

Severity

6.5

First published (updated )

CVE-2024-5872

Arista EOSOn affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being term

Risk 22

Severity

4.3

First published (updated )

CVE-2024-7095

Arista EOSOn affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options ma

Risk 30

Severity

5.8

First published (updated )

CVE-2024-6437

FreeBSD FreeBSDOpenSSH regreSSHion Attack (CVE-2024-6387)

Risk 92

Severity

8.1

Exploited

EPSS

71.47%

First published (updated )

CVE-2024-6387

Arista EOSOn affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.

Risk 43

Severity

7.5

First published (updated )

CVE-2023-3646

Arista EOSOn affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packets

Risk 38

Severity

6.5

First published (updated )

CVE-2023-24548

Arista EOSOn the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

Risk 43

Severity

7.5

First published (updated )

CVE-2023-24510

Arista EOSOn affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI re…

Risk 79

Severity

8.8

First published (updated )

CVE-2023-24512

Arista EOSOn affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...

Risk 77

Severity

9.3

First published (updated )

CVE-2023-24509

Arista EOSOn affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.

Risk 43

Severity

7.5

First published (updated )

CVE-2023-24511

Arista EOSFor certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.

Risk 43

Severity

7.5

First published (updated )

CVE-2021-28510

Arista EOSThis advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches t ...

Risk 40

Severity

6.5

First published (updated )

CVE-2021-28511

Arista EOSTerminAttr streams MACsec sensitive data in clear text to other authorized users in CVP

Risk 45

Severity

6.1

First published (updated )

CVE-2021-28509

Arista EOSTerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP

Risk 61

Severity

6.8

First published (updated )

CVE-2021-28508

Arista EOSOn affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

Risk 43

Severity

7.5

First published (updated )

CVE-2021-28505

Arista EOSOn Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...

Risk 43

Severity

7.5

First published (updated )

CVE-2021-28504

Arista EOSIn Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Risk 86

Severity

9.8

First published (updated )

CVE-2021-28503

Trending

Versions

Arista EOSOn affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption o

Arista EOSA specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted

Arista EOSOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.

Arista EOSn affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.

Arista EOSOn affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal

Don't miss critical vulnerabilities

Arista EOSOn affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries.

Arista EOSOn affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropp

Arista EOSOn affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

Arista EOSOn affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly

Arista EOSOn affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar

Don't miss critical vulnerabilities

Arista EOSOn affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping.

Arista EOSOn affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.

Arista EOSOn affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.

Arista EOSOn affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.

Arista EOSOn affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being term

Don't miss critical vulnerabilities

Arista EOSOn affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options ma

FreeBSD FreeBSDOpenSSH regreSSHion Attack (CVE-2024-6387)

Arista EOSOn affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.

Arista EOSOn affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packets

Arista EOSOn the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

Don't miss critical vulnerabilities

Arista EOSOn affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI re…

Arista EOSOn affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...

Arista EOSOn affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.

Arista EOSFor certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.

Arista EOSThis advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches t ...

Don't miss critical vulnerabilities

Arista EOSTerminAttr streams MACsec sensitive data in clear text to other authorized users in CVP

Arista EOSTerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP

Arista EOSOn affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

Arista EOSOn Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...

Arista EOSIn Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Don't miss critical vulnerabilities

Company

Resources

Contact