Eos (Arista Networks) - vulnerabilities (CVEs)

75 CVEs, 0 in the last 30 days, 16 known versions, newest CVE from 2026-09-16. Vendor: Arista Networks.

CVEs of Eos

CVE-2026-73462 - CVSS 7.1 (high), 2026-09-16: On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a…
CVE-2026-73457 - CVSS 6 (medium), 2026-09-16: Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials…
CVE-2026-73456 - CVSS 10 (critical), 2026-09-16: Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI…
CVE-2026-73442 - CVSS 3 (low), 2026-09-16: On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an…
CVE-2026-73443 - CVSS 5.3 (medium), 2026-09-16: On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on…
CVE-2026-77190 - CVSS 6.5 (medium), 2026-09-16: On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse…
CVE-2026-73468 - CVSS 7.1 (high), 2026-09-16: A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast…
CVE-2026-73440 - CVSS 4.2 (medium), 2026-09-16: On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as…
CVE-2026-73469 - CVSS 6.9 (medium), 2026-09-16: When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the…
CVE-2026-73453 - CVSS 10 (critical), 2026-09-16: An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions…
CVE-2026-73455 - CVSS 8.9 (high), 2026-09-16: On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to…
CVE-2026-73438 - CVSS 7 (high), 2026-09-16: On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast…
CVE-2026-73436 - CVSS 6.5 (medium), 2026-09-16: On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor…
CVE-2026-73435 - CVSS 8.2 (high), 2026-09-16: On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an…
CVE-2026-19640 - CVSS 4.2 (medium), 2026-09-16: On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect…
CVE-2026-73463 - CVSS 6 (medium), 2026-09-16: On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz…
CVE-2026-73445 - CVSS 6.9 (medium), 2026-09-16: On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which…
CVE-2026-2380 - CVSS 7.4 (high), 2026-09-16: On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be…
CVE-2026-73464 - CVSS 8.8 (high), 2026-09-16: On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious…
CVE-2026-73454 - CVSS 8.6 (high), 2026-09-16: On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended…
CVE-2026-73439 - CVSS 7.7 (high), 2026-09-16: On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI…
CVE-2026-73461 - CVSS 9.4 (critical), 2026-09-16: On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong…
CVE-2026-73447 - CVSS 9.4 (critical), 2026-09-16: A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated…
CVE-2026-73450 - CVSS 7 (high), 2026-09-16: On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection…
CVE-2026-73460 - CVSS 7 (high), 2026-09-15: On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can…
CVE-2026-73459 - CVSS 7.4 (high), 2026-09-15: On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the…
CVE-2026-73446 - CVSS 7.4 (high), 2026-09-15: On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol…
CVE-2026-73444 - CVSS 5.3 (medium), 2026-09-15: On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to…
CVE-2026-73437 - CVSS 9.6 (critical), 2026-09-15: On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access…
CVE-2026-19655 - CVSS 7.1 (high), 2026-09-15: On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or…
CVE-2026-73458 - CVSS 9.2 (critical), 2026-09-15: On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause…
CVE-2026-73467 - CVSS 6.3 (medium), 2026-09-15: On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System…
CVE-2026-73466 - CVSS 6.3 (medium), 2026-09-15: On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when…
CVE-2026-73465 - CVSS 6.3 (medium), 2026-09-15: On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when…
CVE-2026-19641 - CVSS 6.9 (medium), 2026-09-15: On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions.…
CVE-2026-73451 - CVSS 6.3 (medium), 2026-09-15: On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode,…
CVE-2026-75945 - CVSS 2.6 (low), 2026-09-14: A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
CVE-2026-75944 - CVSS 5.6 (medium), 2026-09-14: A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this…
CVE-2026-75943 - CVSS 2.6 (low), 2026-09-14: A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due…
CVE-2026-77191 - CVSS 2.6 (low), 2026-09-14: An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window…
CVE-2026-73449 - CVSS 5.9 (medium), 2026-09-14: On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a…
CVE-2026-2379 - CVSS 8.2 (high), 2026-06-05: On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific…
CVE-2026-7473 - CVSS 6.9 (medium), 2026-06-05: On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic…
CVE-2025-8873 - CVSS 8.7 (high), 2026-06-04: On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The…
CVE-2024-27892 - CVSS 9.6 (critical), 2026-06-04: Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in…
CVE-2024-27890 - CVSS 9.6 (critical), 2026-06-04: Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in…
CVE-2023-5502 - CVSS 8.2 (high), 2026-06-04: On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports,…
CVE-2024-27891 - CVSS 6.9 (medium), 2026-06-04: On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets…
CVE-2024-6858 - CVSS 6.5 (medium), 2026-06-04: In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the…
CVE-2025-7048 - CVSS 5.3 (medium), 2026-01-06: On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly.…
CVE-2025-8872 - CVSS 7.1 (high), 2025-12-16: On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which…
CVE-2025-8870 - CVSS 5.6 (medium), 2025-11-14: On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153
CVE-2025-6188 - CVSS 7.5 (high), 2025-08-25: On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with…
CVE-2025-3456 - CVSS 3.8 (low), 2025-08-25: On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs.…
CVE-2025-2826 - CVSS 2.6 (low), 2025-05-27: n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or…
CVE-2025-2796 - CVSS 5.3 (medium), 2025-05-27: On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected…
CVE-2024-11185 - CVSS 6.5 (medium), 2025-05-27: On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with…
CVE-2024-9448 - CVSS 7.5 (high), 2025-05-08: On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy…
CVE-2025-0936 - CVSS 6.5 (medium), 2025-05-07: On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may…
CVE-2024-8000 - CVSS 5.3 (medium), 2025-03-04: On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in…
CVE-2024-9135 - CVSS 5.3 (medium), 2025-03-04: On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing…
CVE-2025-1260 - CVSS 9.1 (critical), 2025-03-04: On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in…
CVE-2025-1259 - CVSS 7.7 (high), 2025-03-04: On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in…
CVE-2024-7095 - CVSS 4.3 (medium), 2025-01-10: On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted…
CVE-2024-5872 - CVSS 6.5 (medium), 2025-01-10: On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane…
CVE-2023-3646 - CVSS 7.5 (high), 2023-08-29: On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause…
CVE-2023-24548 - CVSS 6.5 (medium), 2023-08-29: On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can…
CVE-2023-24545 - CVSS 7.5 (high), 2023-04-12: On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending…
CVE-2023-24511 - CVSS 7.5 (high), 2023-04-12: On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the…
CVE-2023-24513 - CVSS 7.5 (high), 2023-04-12: On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending…
CVE-2021-28510 - CVSS 7.5 (high), 2023-01-26: For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the…
CVE-2021-28511 - CVSS 6.5 (medium), 2022-08-05: This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the…
CVE-2021-28505 - CVSS 7.5 (high), 2022-04-14: On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN…
CVE-2021-28504 - CVSS 7.5 (high), 2022-04-01: On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then…
CVE-2021-28507 - CVSS 7.1 (high), 2022-01-14: An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF…
CVE-2021-28506 - CVSS 9.1 (critical), 2022-01-14: An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a…