Arista restricted shell escape (with privesc)

This exploit module takes advantage of a poorly configured TACACS+ config, Arista's bash shell and TACACS+ read-only account to privilage escalate. A CVSS v3 base score of 9.8 has been assigned. Module Options msf use exploit/unix/ssh/arista/tacplusshell msf undefinedtacplusshell show actions...

OpenSMTPD vulnerable to local privilege escalation and remote code execution

Overview Qualys Research Labs found that the smtpmailaddr function in OpenSMTPD version 6.6 does not properly sanitize user input, which could allow a local attacker to escalate their privileges, and allow either a local or remote attacker to execute arbitrary code as root. Description OpenSMTPD ...

Arista Networks CloudVision Portal Memory Corruption Vulnerability

Arista Networks CloudVision Portal is a suite of web-based user management portals for the CloudVision platform from Arista Networks, USA. The product includes features such as network device configuration, compliance management, change management, and network monitoring and management. A securit...

Arista Networks CloudVision Portal Privilege Vulnerability

Arista Networks CloudVision Portal is a suite of web-based user management portals for the CloudVision platform from Arista Networks, USA. The product includes features such as network device configuration, compliance management, change management, and network monitoring and management. A...

Security Advisory 0044

Security Advisory 0044 PDF Date: December 4th, 2019 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | December 4, 2019 | Initial Release The CVE-ID tracking this issue is: CVE-2019-18181 CVSSv3 Base Score: 5.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N Description: This advisory document...

Security Advisory 0043

Security Advisory 0043 PDF Date: November 6th, 2019 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | November 6th, 2019 | Initial Release The CVE-IDs tracking this issue: CVE-2019-9512, CVE-2019-9514, and CVE-2019-9515 CVSSv3 Base Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description...

Security Advisory 0130

Security Advisory 0130 PDF Date: December 23, 2025 Revision | Date | Changes ---|---|--- 1.0 | October 16, 2019 | Initial release 1.1 | December 23, 2025 | Updated to Arista Format NOTICE: VeloCloud is now an Arista product. Arista Networks has reposted this advisory that was originally posted by...

Unspecified Vulnerability in Arista Networks Extensible Operating System

Arista Networks Extensible Operating System EOS is a suite of scalable operating systems for next-generation data center and cloud solutions from Arista Networks, Inc. in the United States. A security vulnerability exists in the Label Distribution Protocol protocol implementation in Arista Networ...

Security Advisory 0042

Security Advisory 0042 PDF Date: October 9th, 2019 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 9th, 2019 | Initial Release The CVE-IDs tracking this issue are CVE-2019-14810. CVSSv3 Base Score: 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Description This advisory is to document a...

CVE-2018-14008

Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled...

CVE-2018-12357

Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions...

CVE-2018-14008

Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled...

CVE-2018-12357

Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions...

Authentication flaw

Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled...

Code injection

Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions...

CVE-2018-12357

Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions...

CVE-2018-12357

CVE-2018-12357 affects Arista CloudVision Portal up to version 2018.1.1, where an incorrect permissions issue could let an authenticated user with access to Account Management read/write access access sensitive information of other users. The Red Hat and Arista advisories confirm the vulnerabilit...

CVE-2018-14008

Arista EOS vulnerability CVE-2018-14008: EOS up to 4.21.0F crashes due to mishandled 802.1x authentication, enabling DoS on the Dot1x agent when adjacent-network packets are crafted. Affected releases span 4.16–4.21 (specific hotfix and versioning listed in Security Advisory 0038), with mitigatio...

CVE-2018-14008

Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled...

PT-2019-3016 · Google +10 · Golang.Org/X/Net/Http2 +11

Name of the Vulnerable Software and Affected Versions: HTTP/2 implementations affected versions not specified golang.org/x/net/http2 affected versions not specified Arista’s EOS affected versions not specified Arista’s CloudVision Portal affected versions not specified Access Points with OpenConf...