Arista
103 CVEs across 326 Arista products. Browse Arista vulnerabilities, severities, and proof-of-concept exploits.
Arista products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16812 | Critical | 10.0 | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2026-25624 | Medium | 5.7 | 2026-06-05 | An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Gen… |
CVE-2026-25623 | Medium | 6.0 | 2026-06-05 | An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewal… |
CVE-2026-25622 | Medium | 6.0 | 2026-06-05 | A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected p… |
CVE-2026-25621 | Medium | 6.0 | 2026-06-05 | A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input valid… |
CVE-2026-25620 | Medium | 6.0 | 2026-06-05 | An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generat… |
CVE-2026-7473 | Medium | 5.8 | 2026-06-05 | On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Rou… |
CVE-2026-31431 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b09… |
CVE-2025-2767 | Critical | 9.6 | 2025-04-23 | Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-9188 | High | 8.8 | 2025-01-10 | Specially constructed queries cause cross platform scripting leaking administrator tokens |
CVE-2024-9134 | High | 8.3 | 2025-01-10 | Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection… |
CVE-2024-9133 | Medium | 6.6 | 2025-01-10 | A user with administrator privileges is able to retrieve authentication tokens |
CVE-2024-9132 | High | 8.1 | 2025-01-10 | The administrator is able to configure an insecure captive portal script |
CVE-2024-9131 | High | 7.2 | 2025-01-10 | A user with administrator privileges can perform command injection |
CVE-2024-47520 | High | 7.6 | 2025-01-10 | A user with advanced report application access rights can perform actions for which they are not authorized |
CVE-2024-47519 | High | 8.3 | 2025-01-10 | Backup uploads to ETM subject to man-in-the-middle interception |
CVE-2024-47518 | Medium | 6.4 | 2025-01-10 | Specially constructed queries targeting ETM could discover active remote access sessions |
CVE-2024-47517 | Medium | 6.8 | 2025-01-10 | Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access |
CVE-2024-12832 | Medium | 6.3 | 2024-12-20 | Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files… |
CVE-2024-12831 | High | 7.8 | 2024-12-20 | Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2024-12830 | High | 7.3 | 2024-12-20 | Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-12829 | High | 8.8 | 2024-12-20 | Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2024-27889 | High | 8.8 | 2024-03-04 | Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advance… |
CVE-2023-6068 | Low | 3.1 | 2024-03-04 | On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the c… |
CVE-2023-24547 | Medium | 5.9 | 2023-12-06 | On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local… |
CVE-2023-3646 | Medium | 5.9 | 2023-08-29 | On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause syst… |
CVE-2023-24548 | Medium | 5.3 | 2023-08-29 | On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause… |
CVE-2023-24546 | High | 8.1 | 2023-06-13 | On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with netwo… |
CVE-2023-24510 | High | 7.5 | 2023-06-05 | On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart. |
CVE-2023-24512 | High | 8.8 | 2023-04-25 | On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrar… |
CVE-2023-24509 | Critical | 9.3 | 2023-04-13 | On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO… |
CVE-2023-24545 | High | 7.5 | 2023-04-12 | On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malf… |
CVE-2023-24511 | Medium | 5.3 | 2023-04-12 | On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the… |
CVE-2023-24513 | Medium | 6.5 | 2023-04-12 | On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malf… |
CVE-2021-28510 | Medium | 5.3 | 2023-01-26 | For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PT… |
CVE-2022-29071 | Medium | 4.0 | 2022-08-05 | This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of c… |
CVE-2021-28511 | Medium | 5.8 | 2022-08-05 | This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the sec… |
CVE-2021-28509 | Medium | 6.1 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2021-28508 | Medium | 6.8 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2021-28505 | High | 7.5 | 2022-04-14 | On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule… |
CVE-2021-28504 | High | 7.5 | 2022-04-01 | On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that… |
CVE-2021-28503 | High | 7.4 | 2022-02-04 | The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows… |
CVE-2021-28507 | Medium | 5.5 | 2022-01-14 | An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF mig… |
CVE-2021-28506 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a f… |
CVE-2021-28501 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestri… |
CVE-2021-28500 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestri… |
CVE-2021-28496 | Medium | 5.7 | 2021-10-21 | On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectiona… |
CVE-2021-28499 | Medium | 6.3 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users… |
CVE-2021-28498 | High | 8.7 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unpri… |
CVE-2021-28497 | Medium | 4.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible… |
CVE-2021-28495 | High | 7.2 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed… |
CVE-2021-28494 | Critical | 9.6 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unpri… |
CVE-2021-28493 | High | 8.4 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute comma… |
CVE-2020-26147 | Medium | 5.4 | 2021-05-11 | An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plai… |
CVE-2020-26146 | Medium | 5.3 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numb… |
CVE-2020-26144 | Medium | 6.5 | 2021-05-11 | An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the fi… |
CVE-2020-26143 | Medium | 6.5 | 2021-05-11 | An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implementations accept fragmented plaintext fram… |
CVE-2020-26140 | Medium | 6.5 | 2021-05-11 | An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a prote… |
CVE-2020-26139 | Medium | 5.3 | 2021-05-11 | An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfull… |
CVE-2020-24588 | Low | 3.5 | 2021-05-11 | The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the… |
CVE-2020-24587 | Low | 2.6 | 2021-05-11 | The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a fram… |
CVE-2020-24586 | Low | 3.5 | 2021-05-11 | The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be c… |
CVE-2020-25686 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards… |
CVE-2020-25685 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded… |
CVE-2020-25684 | Low | 3.7 | 2021-01-20 | A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destin… |
CVE-2020-24360 | High | 7.4 | 2020-12-28 | An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed… |
CVE-2020-15898 | Medium | 5.3 | 2020-12-28 | In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by… |
CVE-2020-26569 | Medium | 5.9 | 2020-12-28 | In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded ac… |
CVE-2020-15897 | High | 7.5 | 2020-10-26 | Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect… |
CVE-2020-13100 | High | 7.5 | 2020-10-26 | Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to… |
CVE-2020-17355 | High | 7.5 | 2020-10-21 | Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (resta… |
CVE-2020-24333 | Medium | 6.5 | 2020-09-22 | A vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module… |
CVE-2020-3702 | Medium | 6.5 | 2020-09-08 | u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possib… |
CVE-2020-3973 | High | 8.8 | 2020-07-08 | The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orch… |
CVE-2020-11622 | High | 7.5 | 2020-06-10 | A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M… |
CVE-2020-13881 | High | 7.5 | 2020-06-06 | In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. |
CVE-2019-18948 | High | 7.5 | 2020-04-16 | An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN… |
CVE-2020-10188 | Critical | 9.8 | 2020-03-06 | utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overf… |
CVE-2020-9015 | Critical | 9.8 | 2020-02-20 | Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass… |
CVE-2015-6815 | Low | 3.5 | 2020-01-31 | The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which a… |
CVE-2015-5745 | Medium | 6.5 | 2020-01-23 | Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU proc… |
CVE-2015-5278 | Medium | 6.5 | 2020-01-23 | The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possi… |
CVE-2015-5239 | Medium | 6.5 | 2020-01-23 | Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, wh… |
CVE-2019-18181 | High | 7.8 | 2019-12-19 | In CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for restricted functionali… |
CVE-2019-18615 | Medium | 4.9 | 2019-12-19 | In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API c… |
CVE-2019-17596 | High | 7.5 | 2019-10-24 | Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack s… |
CVE-2019-14810 | Medium | 5.9 | 2019-10-10 | A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establi… |
CVE-2018-14008 | Medium | 6.5 | 2019-08-15 | Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled. |
CVE-2018-12357 | Medium | 6.5 | 2019-08-15 | Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions. |
CVE-2018-5254 | High | 7.5 | 2018-04-12 | Arista EOS before 4.20.2F allows remote BGP peers to cause a denial of service (Rib agent restart) via a malformed path attribute in an UPDATE message. |
CVE-2018-5255 | Medium | 6.5 | 2018-03-05 | The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service (agent restart) via crafted UDP p… |
CVE-2017-18017 | Critical | 9.8 | 2018-01-03 | The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a den… |
CVE-2017-14491 | Critical | 9.8 | 2017-10-04 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS resp… |
CVE-2016-9012 | High | 8.8 | 2017-01-23 | CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane… |
CVE-2016-6894 | High | 7.5 | 2017-01-04 | Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.17 before 4.17.0F on DCS-7050 series devices allow remote attackers to cause a denial of service (de… |
CVE-2015-8236 | | 2015-11-19 | Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute ar… | |
CVE-2015-6855 | High | 7.5 | 2015-11-06 | hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly ha… |
CVE-2015-3214 | | 2015-08-31 | The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might… | |
CVE-2015-5165 | | 2015-08-12 | The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap… |