Vulnerabilidades en Arista Networks
129 resultadosAnálisis Vexday
O portfólio de vulnerabilidades da Arista Networks soma 80 CVEs catalogadas, das quais 8 são de severidade crítica e 1 está confirmada em exploração ativa no catálogo KEV da CISA — proporção que coloca o vendor ACIMA da média geral do catálogo em 2,8 vezes, sinalizando atenção redobrada mesmo diante de um volume total relativamente contido. O tipo de falha mais recorrente é CWE-284 (controle de acesso impróprio), padrão que tende a favorecer movimentação lateral e escalada de privilégios em ambientes de rede. A CVE mais perigosa atualmente ativa é CVE-2026-7473, ainda com EPSS de 0,0084, indicando probabilidade de exploração em massa relativamente baixa no curto prazo, mas cuja presença no KEV exige tratamento prioritário. O surgimento de 16 novas CVEs nos últimos 90 dias reforça a necessidade de ciclos de patching contínuos para os operadores desses equipamentos.
CVE-2026-73453CRITICALSecurity Advisory 0174EPSS 0.7%CVE-2024-9132HIGHThe administrator is able to configure an insecure captive portal scriptEPSS 0.7%CVE-2023-24513MEDIUMOn affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options this may cause a recomputation of the TCP checksum ...EPSS 0.7%CVE-2023-3646MEDIUMOn affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.EPSS 0.7%CVE-2021-28507MEDIUMAn issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.EPSS 0.7%CVE-2025-0505CRITICALOn Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system stateEPSS 0.7%CVE-2026-7473MEDIUMArista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding BypassEPSS 0.6%KEVCVE-2026-73464HIGHSecurity Advisory 0166EPSS 0.6%CVE-2024-9134HIGHMultiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.EPSS 0.6%CVE-2023-24510HIGHOn the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.EPSS 0.6%CVE-2026-86108HIGHSecurity Advisory 0181EPSS 0.6%CVE-2024-8100HIGHOn affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.EPSS 0.6%CVE-2023-24512HIGHOn affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. EPSS 0.6%CVE-2025-2826LOWn affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.EPSS 0.6%CVE-2026-25623HIGHArista Edge Threat Management NGFW UI Arbitrary Command ExecutionEPSS 0.6%CVE-2024-9448HIGHOn affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be droppEPSS 0.6%CVE-2021-28511MEDIUMThis advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches t ...EPSS 0.6%CVE-2025-6979HIGHCaptive Portal can allow authentication bypassEPSS 0.5%CVE-2021-28508MEDIUMTerminAttr streams IPsec sensitive data in clear text to other authorized users in CVPEPSS 0.5%CVE-2024-6437MEDIUMOn affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options maEPSS 0.5%