1415 matches found
CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass
README.md markdown CVE-2026-7473 - Arista EOS Tunnel Decapsulation Bypass ⚠️ WARNING This code is ONLY for educational purposes and authorized security testing. 📋 Description CVE-2026-7473 is a vulnerability in Arista EOS where a switch configured as a tunnel endpoint VXLAN, GRE, decap-groups...
CVE-2025-6980-check
Arista NGFW Sensitive Information Disclosure Check Arista NGFW CVE-2025-6980 scanner by Bishop Fox Tests a target for info disclosure CVE-2025-6980 Does not perform any administrative actions on the target For more information about this vulnerability, refer to the Bishop Fox blog. Setup git clon...
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator VCO to its Known Exploited Vulnerabilities KEV, citing reports of active exploitation in the wild. The...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses...
Security Advisory 0201
Security Advisory 0201 PDF Revision | Date | Changes ---|---|--- 1.0 | October 23, 2026 | Initial release 1.1 | October 26, 2026 | Updated some mitigation details and added more Streaming Telemetry Agent fixed versions 1.2 | October 29, 2026 | Further clarifications and additional release version...
Arista VeloCloud Orchestrator SQL Injection Vulnerability
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data...
CVE-2026-102168
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remot...
CVE-2026-102169
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent...
CVE-2026-102162
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a...
CVE-2026-102167
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...
CVE-2026-102163
On affected Arista access points with Wireless Intrusion Prevention System WIPS active, an unauthenticated attacker within radio frequency RF proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution...
CVE-2026-102164
On affected Arista access points configured with VXLAN tunnelling and L2-proxy a specific configuration unique to the VESPA use-case, a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write...
CVE-2026-102165
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode...
CVE-2026-102167
A memory corruption vulnerability exists in the wired uplink network endpoints of affected Arista Wi-Fi access points . This flaw, categorized as a stack-based buffer overflow (CWE-121), allows an unauthenticated attacker positioned on the same network segment as the wired uplink to crash the sen...
CVE-2026-102165 Security Advisory 0198
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode...
CVE-2026-102167 Security Advisory 0197
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...
EUVD-2026-93968
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode...
EUVD-2026-93967
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...
CVE-2026-102165 Security Advisory 0198
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode...
CVE-2026-102167 Security Advisory 0197
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network...