PT-2025-23043 · Arista · Arista Eos

Name of the Vulnerable Software and Affected Versions: Arista EOS affected versions not specified Description: On affected platforms running Arista EOS, ACL policies may not be enforced. This issue affects IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more...

PT-2025-23040 · Arista · Arista Eos

Name of the Vulnerable Software and Affected Versions: Arista EOS affected versions not specified Description: The issue affects Arista EOS with IPsec enabled and anti-replay protection configured on platforms with hardware IPSec support. In specific cases, EOS may exhibit unexpected behavior,...

Security Advisory 0120

Security Advisory 0120 . CSAF PDF Date: May 27, 2025 Revision | Date | Changes ---|---|--- 1.0 | May 27, 2025 | Initial release The CVE-ID tracking this issue: CVE-2025-2826 CVSSv3.1 Base Score: 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Common Weakness Enumeration: CWE-284: Improper Access...

Security Advisory 0119

Security Advisory 0119 . CSAF PDF Date: May 27, 2025 Revision | Date | Changes ---|---|--- 1.0 | May 27, 2025 | Initial release 1.1 | June 4, 2025 | Updated Resolutions Section and Affected EOS Version The CVE-ID tracking this issue: CVE-2025-2796 CVSSv3.1 Base Score: 5.3...

Arista EOS 安全漏洞

Arista EOS is a fully programmable, highly modular, Linux-based network operating system from Arista Corporation. A security vulnerability exists in Arista EOS that stems from the possibility of incorrectly forwarding Layer 2 port ingress traffic under certain conditions, resulting in a breach of...

PT-2025-23039 · Arista · Arista Eos

Name of the Vulnerable Software and Affected Versions: Arista EOS affected versions not specified Description: The issue affects Arista EOS, where ingress traffic on Layer 2 ports may be improperly forwarded to ports associated with different VLANs under certain conditions, resulting in a breach ...

Arista EOS 安全漏洞

Arista EOS is a fully programmable, highly modular, Linux-based network operating system from Arista Corporation. A security vulnerability exists in Arista EOS that stems from an ACL policy that may not be enforced, which could result in packets being incorrectly allowed or denied...

Arista EOS 安全漏洞

Arista EOS is a fully programmable, highly modular, Linux-based network operating system from Arista Corporation. A security vulnerability exists in Arista EOS that stems from the possibility of incorrectly forwarding duplicate encrypted packets that should be discarded under certain circumstance...

CVE-2020-9015

Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices and possibly other products allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly...

CVE-2020-24333

A vulnerability in Arista’s CloudVision Portal CVP prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API...

CVE-2020-15898

In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic ex. UDP and not bidirectional traffic ex. TCP. This affects: EOS 7170 platforms version 4.21.4.1F and below releas...

CVE-2020-24360

An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. The affected Arista EOS versions are: 4.24.2.4F and below releases in the 4.24.x train; 4.23.4M and below releases in...

CVE-2020-11622

A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368., 4.21.4-FCRFX., 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1...

CVE-2018-14008

Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled...

Security Advisory 0118

Security Advisory 0118 . CSAF PDF Date: May 20, 2025 Revision | Date | Changes ---|---|--- 1.0 | May 20, 2025 | Initial release The CVE-ID tracking this issue: CVE-2024-11185 CVSSv3.1 Base Score: 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Common Weakness Enumeration: CWE-1189: Improper...

CVE-2024-9448

On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if th...

CVE-2024-8100

On affected versions of the Arista CloudVision Portal CVP on-prem, the time-bound device onboarding token can be used to gain admin privileges on CloudVision...

CVE-2024-11186

On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise. It does not impact CloudVision...

CVE-2024-12378

On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear...

CVE-2025-0505

On Arista CloudVision systems virtual or physical on-premise deployments, Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that...