Vulnerabilidades em Arista Networks

154 resultados
Análise Vexday

O portfólio de vulnerabilidades da Arista Networks soma 80 CVEs catalogadas, das quais 8 são de severidade crítica e 1 está confirmada em exploração ativa no catálogo KEV da CISA — proporção que coloca o vendor ACIMA da média geral do catálogo em 2,8 vezes, sinalizando atenção redobrada mesmo diante de um volume total relativamente contido. O tipo de falha mais recorrente é CWE-284 (controle de acesso impróprio), padrão que tende a favorecer movimentação lateral e escalada de privilégios em ambientes de rede. A CVE mais perigosa atualmente ativa é CVE-2026-7473, ainda com EPSS de 0,0084, indicando probabilidade de exploração em massa relativamente baixa no curto prazo, mas cuja presença no KEV exige tratamento prioritário. O surgimento de 16 novas CVEs nos últimos 90 dias reforça a necessidade de ciclos de patching contínuos para os operadores desses equipamentos.

CVE-2026-73457MEDIUMUnder certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.EPSS 0.3%CVE-2026-102163HIGHSecurity Advisory 0195EPSS 0.3%CVE-2026-101151MEDIUMSecurity Advisory 0187EPSS 0.3%CVE-2026-19655HIGHOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthentEPSS 0.3%CVE-2024-27892HIGHOn affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).EPSS 0.3%CVE-2025-8872HIGHA specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restartedEPSS 0.3%CVE-2026-73444MEDIUMOn affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim theEPSS 0.3%CVE-2026-73469MEDIUMSecurity Advisory 0176EPSS 0.3%CVE-2026-17192MEDIUMVeloCloud Orchestrator Missing Input Validation SSRFEPSS 0.3%CVE-2026-73468HIGHSecurity Advisory 0175EPSS 0.3%CVE-2026-101156MEDIUMSecurity Advisory 0192EPSS 0.3%CVE-2026-102156MEDIUMSecurity Advisory 0191EPSS 0.3%CVE-2026-102158HIGHSecurity Advisory 0190EPSS 0.3%CVE-2025-0936MEDIUMOn affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possiblyEPSS 0.3%CVE-2026-101158CRITICALSecurity Advisory 0185EPSS 0.3%CVE-2024-27891MEDIUMOn affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.EPSS 0.3%CVE-2026-77190MEDIUMSecurity Advisory 0177EPSS 0.3%CVE-2026-73462HIGHOn affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IEPSS 0.3%CVE-2026-102169HIGHSecurity Advisory 0194EPSS 0.3%CVE-2026-102168HIGHSecurity Advisory 0194EPSS 0.3%