Arista Eos
46 CVEs affecting Arista Eos. Latest disclosed: 2026-06-05. Critical: 8, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10188 | Critical | 9.8 | 2020-03-06 | utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overf… |
CVE-2017-18017 | Critical | 9.8 | 2018-01-03 | The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a den… |
CVE-2017-14491 | Critical | 9.8 | 2017-10-04 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS resp… |
CVE-2014-7169 | Critical | 9.8 | 2014-09-25 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows re… |
CVE-2014-6271 | Critical | 9.8 | 2014-09-24 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arb… |
CVE-2023-24509 | Critical | 9.3 | 2023-04-13 | On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO… |
CVE-2021-28506 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a f… |
CVE-2021-28500 | Critical | 9.1 | 2022-01-14 | An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestri… |
CVE-2023-24512 | High | 8.8 | 2023-04-25 | On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrar… |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2023-24510 | High | 7.5 | 2023-06-05 | On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart. |
CVE-2021-28505 | High | 7.5 | 2022-04-14 | On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule… |
CVE-2021-28504 | High | 7.5 | 2022-04-01 | On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that… |
CVE-2020-15897 | High | 7.5 | 2020-10-26 | Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect… |
CVE-2020-17355 | High | 7.5 | 2020-10-21 | Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (resta… |
CVE-2019-18948 | High | 7.5 | 2020-04-16 | An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN… |
CVE-2019-17596 | High | 7.5 | 2019-10-24 | Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack s… |
CVE-2018-5254 | High | 7.5 | 2018-04-12 | Arista EOS before 4.20.2F allows remote BGP peers to cause a denial of service (Rib agent restart) via a malformed path attribute in an UPDATE message. |
CVE-2015-6855 | High | 7.5 | 2015-11-06 | hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly ha… |
CVE-2021-28503 | High | 7.4 | 2022-02-04 | The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows… |