Skip to content
OpenAdvisories
High WID-SEC-2024-0489 2 CVEs

Arista EOS: Mehrere Schwachstellen ermöglichen Codeausführung

Published Feb 27, 2024 · Updated Jun 4, 2026 · Revision 3 · de-DE

Vendor: Arista Networks Product: EOS Platform: Linux Platform: Windows

Summary

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Arista EOS ausnutzen, um beliebigen Code auszuführen.

Product

Arista Extensible Operating System (EOS) ist ein modulares Linux basiertes Netzwerkbetriebssystem.

Vulnerabilities 2

  • Critical 9.6
    CVE-2024-27892

    On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).

    Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

    Arista Networks EOS Network devices
  • High 8.8
    CVE-2024-27889

    Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).

    Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands …

    Arista Networks Arista Edge Threat Management - Arista NG Firewall (NGFW) Network devices Browsers

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2024-55613

  2. #2

    CVE ergänzt

  3. #1

    Initiale Fassung

References