Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Arista Subscribe
Filtered by product Eos
Total 36 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-25684 4 Arista, Debian, Fedoraproject and 1 more 4 Eos, Debian Linux, Fedora and 1 more 2022-02-14 4.3 MEDIUM 3.7 LOW
A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
CVE-2015-6855 6 Arista, Canonical, Debian and 3 more 7 Eos, Ubuntu Linux, Debian Linux and 4 more 2021-12-15 5.0 MEDIUM 7.5 HIGH
hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash.
CVE-2015-6815 7 Arista, Canonical, Fedoraproject and 4 more 11 Eos, Ubuntu Linux, Fedora and 8 more 2021-11-30 2.7 LOW 3.5 LOW
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
CVE-2015-5278 4 Arista, Canonical, Fedoraproject and 1 more 4 Eos, Ubuntu Linux, Fedora and 1 more 2021-11-30 4.0 MEDIUM 6.5 MEDIUM
The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
CVE-2019-17596 6 Arista, Debian, Fedoraproject and 3 more 11 Cloudvision Portal, Eos, Mos and 8 more 2021-11-30 5.0 MEDIUM 7.5 HIGH
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.
CVE-2020-10188 5 Arista, Debian, Fedoraproject and 2 more 5 Eos, Debian Linux, Fedora and 2 more 2021-11-30 10.0 HIGH 9.8 CRITICAL
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.
CVE-2019-18948 1 Arista 1 Eos 2021-07-21 5.0 MEDIUM 7.5 HIGH
An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M and below releases in the 4.22.x train, 4.23.1F and below releases in the 4.23.x train, and all releases in 4.15, 4.16, 4.17, 4.18, 4.19, 4.20 code train.
CVE-2020-26569 1 Arista 47 7010t-48, 7050cx3-32s, 7050cx3m-32s and 44 more 2021-01-27 4.3 MEDIUM 5.9 MEDIUM
In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded across VLAN boundaries. This can result in traffic being discarded on the receiving VLAN. This affects versions: 4.21.12M and below releases in the 4.21.x train; 4.22.7M and below releases in the 4.22.x train; 4.23.5M and below releases in the 4.23.x train; 4.24.2F and below releases in the 4.24.x train.
CVE-2020-24360 1 Arista 27 7280cr2ak-30, 7280cr2k-60, 7280cr3-32d4 and 24 more 2021-01-05 6.1 MEDIUM 7.4 HIGH
An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. The affected Arista EOS versions are: 4.24.2.4F and below releases in the 4.24.x train; 4.23.4M and below releases in the 4.23.x train; 4.22.6M and below releases in the 4.22.x train.
CVE-2020-15898 1 Arista 49 7050cx3-32s, 7050cx3m-32s, 7050qx-32s and 46 more 2021-01-04 5.0 MEDIUM 5.3 MEDIUM
In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train.
CVE-2020-15897 1 Arista 1 Eos 2020-11-02 5.0 MEDIUM 7.5 HIGH
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed link-state PDU to the IS-IS router.
CVE-2020-17355 1 Arista 1 Eos 2020-11-02 4.3 MEDIUM 7.5 HIGH
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (restart of agents) by crafting a malformed DHCP packet which leads to an incorrect route being installed.
CVE-2018-5255 1 Arista 1 Eos 2019-10-02 4.0 MEDIUM 6.5 MEDIUM
The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service (agent restart) via crafted UDP packets.
CVE-2018-14008 1 Arista 1 Eos 2019-08-28 3.3 LOW 6.5 MEDIUM
Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.
CVE-2018-5254 1 Arista 1 Eos 2018-05-18 5.0 MEDIUM 7.5 HIGH
Arista EOS before 4.20.2F allows remote BGP peers to cause a denial of service (Rib agent restart) via a malformed path attribute in an UPDATE message.
CVE-2015-8236 1 Arista 1 Eos 2015-11-19 10.0 HIGH N/A
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.