Summary
Ein Angreifer kann mehrere Schwachstellen in Arista EOS ausnutzen, um erweiterte Berechtigungen, sogar Administratorrechte, zu erlangen, beliebigen Code, einschließlich Root-Code, auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen sowie Denial-of-Service-Zustände herbeizuführen.
Product
Arista Extensible Operating System (EOS) ist ein modulares Linux basiertes Netzwerkbetriebssystem.
Vulnerabilities 23
-
Critical 10.0
Security Advisory 0174
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default…
-
Critical 10.0
Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full admini…
-
Critical 9.6
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, an…
-
Critical 9.6
Security Advisory 0179
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
-
Critical 9.1
Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to e…
-
High 8.0
Security Advisory 0163
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non…
-
High 7.5
Security Advisory 0164
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy i…
-
High 7.5
Security Advisory 0173
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
-
High 7.4
Security Advisory 0160
On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in…
-
High 7.4
Security Advisory 0160
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic …
-
Medium 6.9
Security Advisory 0161
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLA…
-
Medium 6.5
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthentica…
-
Medium 6.5
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP…
-
Medium 6.5
Security Advisory 0175
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
-
Medium 6.5
Security Advisory 0177
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpecte…
-
Medium 6.1
Security Advisory 0160
On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss …
-
Medium 5.9
Security Advisory 0180
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the a…
-
Medium 5.8
Security Advisory 0176
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could st…
-
Medium 5.3
Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.
-
Medium 4.7
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefini…
-
Medium 4.7
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the vir…
-
Medium 4.2
Security Advisory 0178
On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An au…
-
Low 3.0
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwar…
Revision history
-
#3
Referenz(en) aufgenommen: EUVD-2026-80658, EUVD-2026-81010, EUVD-2026-81008, EUVD-2026-81006, EUVD-2026-81000, EUVD-2026-80996, EUVD-2026-80390, EUVD-2026-80591, EUVD-2026-80590, EUVD-2026-80388, EUVD-2026-80592, EUVD-2026-80587, EUVD-2026-80588
-
#2
Referenz(en) aufgenommen: EUVD-2026-80003, EUVD-2026-80009, EUVD-2026-80007, EUVD-2026-80064, EUVD-2026-80066, EUVD-2026-80065, EUVD-2026-80216, EUVD-2026-80083
-
#1
Initiale Fassung
References
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24711-security-advisory-0155
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24715-security-advisory-0159
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24717-security-advisory-0161
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24719-security-advisory-0163
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24720-security-advisory-0164
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24729-security-advisory-0173
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24731-security-advisory-0175
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24732-security-advisory-0176
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24733-security-advisory-0177
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24734-security-advisory-0178
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179
-
Arista Security Advisory vom 2026-09-09
https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180