Arista
Monthly
Memory corruption in the wired-uplink network endpoints of Arista Wi-Fi access points lets an unauthenticated attacker who already sits on the same Layer-2 segment as the AP's wired uplink crash the sensor service and, under specific preconditions, potentially achieve remote code execution. No authentication or user interaction is required, but the vulnerability is scored adjacent-network (AV:A) with an explicit attack precondition (AT:P in the CVSS 4.0 vector), so the dependable outcome is a denial-of-service crash of the sensor service while full code execution is condition-dependent; no public exploit code has been identified at time of analysis. Because exploitation demands Layer-2 adjacency to the uplink segment, segmentation of management/uplink VLANs is the single most effective exposure reducer.
Unauthenticated adjacent-network attackers can crash or potentially execute arbitrary code on Arista Wi-Fi access points when the packet-capture service is running in an uncommon non-default streaming mode. The flaw is a stack-based buffer overflow (CWE-121) triggered by a crafted packet to the capture service; no authentication or user interaction is required, but the attacker must have Layer-2/adjacent access and the target must already have the non-default streaming mode enabled, so default-configured devices are not exposed. No public exploit code was identified at time of analysis, and this is a conditional priority rather than a drop-everything emergency because exploitation depends on that deliberately enabled configuration.
Unauthenticated, network-adjacent attackers can crash - and potentially execute arbitrary code on - Arista Wi-Fi access points by sending a crafted packet to the wireless gateway service, provided the captive portal or application firewall feature is enabled on at least one SSID. The flaw is a stack-based buffer overflow (CWE-121) rated 9.4 under CVSS 4.0 (AV:A/AC:L/PR:N/UI:N with all impact metrics High and scope change), and because the wireless gateway service restarts automatically after a crash, an attacker can retry indefinitely. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not listed in CISA KEV); exposure is limited to devices where a vulnerable feature is actually enabled and to attackers within wireless range or on an adjacent network segment.
In Arista CV-CUE, an unauthenticated attacker can forge their apparent source IP address and obtain administrative session privileges on the CV-CUE backend, effectively bypassing authentication (CWE-290). The attacker must either be positioned on an adjacent private network segment reachable by the backend, or route requests through a reverse proxy or load balancer that forwards client-supplied headers such as X-Forwarded-For without sanitising them; no credentials and no user interaction are required. Rated CVSS 4.0 8.7 (and scored 8.7-equivalent high impact under the independent CVSS 3.1 assessment with AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H), this is a credible high-priority authentication-bypass issue. There is no public exploit identified at time of analysis, and exploitation is bounded by network reachability and header-handling configuration in front of the backend. Patch availability is not confirmed in the provided data; consult the Arista security advisory 0190.
OS command injection in Arista CloudVision CUE backup management allows an authenticated Super User to execute arbitrary commands with the privileges of the affected service by submitting a crafted backup request. Exploitation is access-gated: it requires the highest application privilege level (PR:H), so anonymous or low-privileged remote users cannot trigger it; the issue functions as an application-admin-to-OS escalation. No public exploit identified at time of analysis, and no EPSS score or KEV status was provided; the independent assessment characterizes this as a genuine but access-gated vulnerability rather than a mass-exploitation threat.
Unauthenticated network attackers can reach backend functionality in Arista CV-CUE that is intended only for internal services, giving them access to sensitive location information and the ability to disrupt affected services. The root cause is a missing authentication check (CWE-306) on internal-service endpoints, rated 9.3 under CVSS 4.0 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality, integrity and availability impact within the vulnerable component; an independent assessment agrees the flaw is remotely reachable and requires no credentials, configuration change or user interaction, but stresses that the real-world exploitability depends on network exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiting factor is whether the internal endpoints are exposed to untrusted networks or are segmented behind a trusted management network.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Authenticated users of the Arista Spectralight WiFi-server application can submit crafted XML requests that trigger external-entity resolution and disclose arbitrary local files from the server, with a secondary partial denial-of-service effect from entity processing. Exploitation requires valid credentials (CVSS 4.0 vector shows PR:L; the independent assessment concurs with PR:L) and network reach to an XML-accepting endpoint, so the realistic threat population is insiders or attackers who have already obtained an account rather than unauthenticated internet scanners. No public exploit code and no CISA KEV listing were identified at time of analysis, and the issue is rated CVSS 7.1 / CWE-611 - a moderate-severity, authentication-gated information-disclosure flaw rather than a top-tier emergency.
Stored cross-site scripting in the Arista CloudVision Fileserver upload API lets an attacker who holds a valid CloudVision account with file-upload privileges persist a malicious payload that executes in another user's browser session. Because the missing input validation allows unsanitized content to be stored and later rendered, a successful hijack of an administrator's web session can yield full account and administrative access, which is why the issue carries a 9.3 CVSS 4.0 base score; the independent assessment concurs (CVSS 3.1 8.0-class impact with S:C). Exploitation is not anonymous - it requires authenticated upload privileges (PR:L) and, critically, active interaction from a victim who must view the stored content (UI:A), so the highest-impact outcome depends on an administrator rendering the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the headline 9.3 should be read with that nuance rather than as an unauthenticated remote compromise.
Stored cross-site scripting in Arista networking software (documented in Arista Security Advisory 0192) lets an unauthenticated attacker who can reach the affected interface from an adjacent network plant malicious content that later executes in the browser of an authenticated user who views it. Exploitation requires the one-two punch of adjacent-network reachability (CVSS AV:A) plus a logged-in victim rendering the stored payload (UI:A), so the attacker gains no privileges at injection time but can hijack the victim's authenticated session, read sensitive data, alter system state, or disrupt the service once the payload fires. Arista PSIRT rates this Critical at CVSS 4.0 base 9.3, and there is no public exploit code and no indication of active exploitation (not listed in CISA KEV) at the time of analysis.
Path traversal in the Software Management Studio Software Repository (CWE-22) allows an authenticated remote user with repository-level privileges to read and write files anywhere on the underlying platform filesystem, far outside the repository's intended storage scope, by sending specially crafted requests or crafted file uploads. Successful exploitation results in complete loss of confidentiality, integrity and availability for the affected system (CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.6 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The decisive limiting factor is the high-privilege prerequisite (PR:H) combined with the absence of any public exploit identified at time of analysis, so realistic risk is concentrated in insider misuse or reuse of already-compromised privileged repository credentials rather than opportunistic external attack; this is a conditional priority, not a drive-by threat.
Authenticated high-privilege users on Arista EOS can exploit a path traversal (CWE-22) in the Network Provisioning Image Repository to read or write files anywhere on the platform filesystem, escaping the intended storage scope via crafted requests or malicious file uploads. The issue requires valid credentials with image-repository permissions (CVSS PR:H), so the exploit population is limited to insiders or attackers who have already compromised a privileged account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality and integrity impact makes this a mid-to-high priority for affected deployments.
Unintended data can be extracted from Arista CloudVision Sensor by authenticated high-privilege users exploiting a path traversal flaw in CloudVision Portal (on-premises) and CloudVision Sensor, though the requirement for high privileges and additional preconditions limits the risk to moderate priority. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited. The flaw primarily impacts confidentiality, with no integrity or availability impact on the vulnerable component according to the independent assessment.
Insufficient validation in the Single Sign-On (SSO) login flow of Arista CloudVision lets a remote, unauthenticated attacker craft a login URL that, once clicked by a user, causes the identity provider to send IdP-issued authentication material to an attacker-controlled URL rather than to CloudVision (CWE-601 open redirect), resulting in credential/assertion theft and potential account impersonation. The vulnerability is rated High (vendor CVSS 4.0 7.6; assessed CVSS 3.1 7.6, AV:N/AC:H/PR:N/UI:R with High confidentiality and integrity impact) and only affects deployments where CloudVision SSO is configured and in use. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on victim interaction plus specific SSO/IdP configuration and the attacker's ability to produce a redirect accepted by the deployment.
Malformed IGMP packets sent by a network-adjacent, unauthenticated attacker can terminate the IGMP snooping agent on Arista EOS switches, causing multicast traffic to flood to all ports of the affected VLAN until the agent recovers. Because IGMP snooping is enabled by default on all VLANs in EOS, most deployments are exposed out of the box, but the attacker needs Layer 2 adjacency to a target VLAN (a compromised host, rogue device, or insider on the switched segment) rather than arbitrary internet reachability, and the impact is a bounded, self-recovering availability disruption that must be repeatedly triggered to be prolonged. No public exploit code and no confirmed active exploitation were identified at time of analysis; the realistic risk is a genuine but non-critical availability concern rather than a priority-one emergency.
An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.
Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.
A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks.
Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); no EPSS score was provided. The vendor has published security advisory SA-0166 at https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166.
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.
Authenticated command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) allows administrators with existing access to the browser management pipeline to break out and execute arbitrary terminal/shell script code on the underlying appliance OS. The flaw stems from insufficient input validation (CWE-78) within management-plane functionality and carries a CVSS 4.0 score of 7.0 with no public exploit identified at time of analysis. Because exploitation requires high-privileged authentication, the issue is a privilege-boundary breach rather than an unauthenticated remote takeover.
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) Captive Portal Custom Handler allows administrators authenticated to the management UI to execute arbitrary shell commands on the underlying platform. The CVSS 4.0 score of 7.0 reflects high privilege requirements (PR:H) offset by network reach and high confidentiality impact, with no public exploit identified at time of analysis.
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows high-privileged authenticated attackers to abuse insecure input validation in the Reports application to execute OS commands on the appliance. The flaw uniquely affects 17.4.0, with earlier releases unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score is 7.0 with confidentiality high and integrity/availability low, reflecting a scope-changing impact constrained by the high privileges required.
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows authenticated high-privileged remote attackers to inject OS commands through the Captive Portal application framework via encrypted password handling. The flaw is unique to release 17.4.0 with earlier versions unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score of 7.0 reflects high attacker privilege requirement balanced against high confidentiality impact on the firewall appliance.
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
CloudVision CUE versions 2021.2.0 through 2026.2.0 contain an insecure direct object reference (IDOR) in the file-serving interface that allows an authenticated, low-privileged network user to read another user's transient data. Exploitation is opportunistic because the victim's transient data must be present at the moment of attack, and the attacker cannot modify or delete data (confidentiality impact only, with low availability impact). No public exploit code or active exploitation has been identified at time of analysis; the vendor CVSS 4.0 base score is 6.0 (medium severity), and independent assessment concurs with a moderate triage priority.
LDAP query injection in Arista CloudVision CUE (versions 2021.2.0 through 2026.2.0) lets an unauthenticated network attacker manipulate directory-service queries when the appliance is configured to authenticate against an external LDAP directory. Exploitation is gated by high attack complexity (CVSS AC:H), meaning the attacker must land on specific conditions largely outside their control - such as a particular directory schema or query-construction path - and the resulting impact is confined to the confidentiality of the downstream directory service (scope-changed C:H), with no direct confidentiality, integrity, or availability effect on CloudVision CUE itself. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS data was not provided, and the issue should be treated as a moderate-priority hardening item rather than an emergency.
Stored cross-site scripting in Arista CloudVision CUE can let an authenticated, high-privilege administrator store malicious content in a configuration that later executes in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation could allow the attacker to act through the victim's authenticated session to access sensitive data, modify configurations, or disrupt managed wireless services. The issue is rated medium (6.2), requires high privileges and victim interaction, and no public exploit was identified at time of analysis.
Open redirect in the Arista CloudVision Portal login flow (CWE-601) lets a remote, unauthenticated attacker craft a login URL that, once a victim clicks it and completes the normal authentication process, sends that user's browser to an arbitrary external site. The issue carries a CVSS 4.0 base score of 5.3 and was assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N; the attacker needs no credentials but cannot trigger the redirect without victim interaction, and impact is limited to browser redirection with low confidentiality loss - primarily useful for enabling phishing or credential theft rather than code execution or data modification. Affected releases are CloudVision Portal 2020.3.0 through <2025.3.0, 2025.3.0 ≤2025.3.3, 2026.1.0 ≤2026.1.2, and 2026.2.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available per the Arista security advisory.
Server-side request forgery (SSRF) in Arista CloudVision Portal allows an authenticated user with high privileges to manipulate the OIDC bearer token configuration and direct requests to arbitrary destinations. Affected versions include 2023.3.0 before 2025.3.0, 2025.3.0 through 2025.3.3, 2026.1.0 through 2026.1.2, and 2026.2.0. Exploitation requires pre-existing elevated access, limiting impact to subsequent-system confidentiality; no public exploit identified at time of analysis.
Arista EOS devices configured with SNMPv3 users store the one-way hashed, localized SNMPv3 authentication key inside the running configuration and, notably, inside sanitized configuration exports, so any authenticated user who can read either artifact obtains reusable credential material for that device's SNMP engine. With that material an attacker can issue unauthorized SNMP read operations against MIB tables or inject fraudulent trap notifications into the Network Management System, though there is no configuration-write or availability impact. The vendor discovered the flaw internally, states it is unaware of malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), with exploitation gated on SNMPv3 being in use and on the attacker already holding authenticated device access or a leaked sanitized configuration.
Loose-mode Unicast Reverse Path Forwarding (uRPF) on certain Arista EOS platforms can fail to drop traffic that the configured source-address verification should have rejected, so packets that ought to be filtered are still processed and forwarded by the switch or router. Only devices running Arista EOS on one of the specific (unnamed) affected platforms and explicitly configured with loose uRPF are exposed - default deployments that do not enable uRPF are not affected, and there is no confidentiality or availability impact, only a loss of filter integrity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor CVSS score of 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) is well calibrated to this narrow, configuration-dependent filtering failure.
A crafted OSPFv2 packet delivered by an adjacent OSPF neighbor can force an unexpected restart of the OSPF process on Arista EOS devices that run both OSPFv2 and OSPFv2 segment routing, producing an availability-only denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only deployments with segment routing enabled under OSPF are exposed, since this is not a default OSPF setting, and the attacker must already be positioned on the same routing segment or link (typically a compromised or rogue device inside the OSPF domain) rather than an arbitrary internet host. No authentication or user interaction is required once adjacency is achievable, repeated packets can sustain the outage, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization results in Arista EOS gNMI (gRPC Network Management Interface) can allow an already-authenticated management user to reach resources and operations slightly beyond the permissions assigned to their role. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.2), exploitation requires the gNMI interface to be enabled and reachable plus a valid account with at least some gNMI access, and success depends on specific role/permission configurations - a high-complexity, low-impact condition rather than a remote unauthenticated bypass. There is no public exploit identified at time of analysis, no CISA KEV listing, and Arista states the issue was found internally with no known malicious use in customer networks.
Arista EOS 4.36.0 through 4.36.1F contains a race condition in IEEE 802.1X port-based Network Access Control that can leave a supplicant in an authorized state after an administrator explicitly issues the 'clear dot1x host all' deauthorization command. The flaw (CWE-459: Incomplete Cleanup) means that a device intended to be removed from the network may retain valid access, undermining the administrative action entirely. No public exploit code exists and SSVC exploitation status is confirmed as none; however, the integrity gap created - a device that should be denied access remaining authorized - is the primary concern for network access control posture.
Cross-site scripting in the Arista Edge Threat Management Next Generation Firewall web UI dashboard allows a high-privileged attacker to inject unvalidated input that is reflected back into administrative profiles, enabling script execution in the context of other administrative sessions. The vulnerability carries a CVSS 4.0 score of 5.8 (Medium), with confidentiality impact rated High on the vulnerable system - consistent with session token or credential harvesting from targeted admin accounts. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Cryptographic validation of Arista EOS software upgrade images can be bypassed when a specifically crafted file is dropped into the upgrade ISO, allowing a tampered image to be accepted as genuine because integrity checking does not fail closed. The flaw is local and operator-dependent: an attacker must already have write access to stage content on the upgrade media (PR:L) and an administrator must then actually run the upgrade from that tampered ISO (UI:R), as reflected in CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N (5.9). There is no confidentiality or availability impact - the payoff is integrity loss (I:H) with a scope change, meaning the compromised image can influence components beyond the upgrade process itself; no public exploit code has been identified at time of analysis and the EPSS score is negligible (0.09%, 0th percentile), so this is a moderate, config/operator-dependent integrity issue rather than an urgent remote-exploitation priority.
Information disclosure in Arista EOS allows authenticated low-privilege (restricted) users to view sensitive configuration database contents, including user password hashes, through a debug API. With a CVSS score of 4.3 and a low EPSS score of 0.22%, this is a moderate-risk flaw that requires a valid restricted account and is read-only in impact; no public exploit has been identified at time of analysis.
Session expiration bypass in Arista EOS allows authenticated local attackers to perform file-system operations (e.g., scp, sftp) on multiplexed SSH sessions after a configured timeout has expired, provided SSH session multiplexing is configured on the client side. Exploitation requires a low-privileged SSH user (PR:L) and local access (AV:L), and only affects specific Arista platforms; default deployments without client-side multiplexing are not exposed. No public exploit code or active exploitation has been identified, and EPSS is low (0.11%, percentile 1%).
Restricted SSH users on Arista EOS can exploit improper permission assignment (CWE-732) to use SSH port forwarding to reach host-internal services normally inaccessible to their role, enabling information disclosure and limited integrity impact. Exploitation requires an authenticated restricted account and SSH forwarding to be enabled; the assessed vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. No public exploit identified at time of analysis.
Authentication bypass in Arista's Captive Portal (CVE-2025-6979, documented as security advisory SA-0123) allows a remote, unauthenticated attacker to reach resources that the portal is supposed to protect, with high impact to confidentiality, integrity and availability (CVSS 8.8). Exposure is limited to environments where the captive portal feature is actually deployed - typically guest or onboarding access control on Arista wireless and edge infrastructure - and the assessed vector requires user interaction (UI:R), which rules out fully automated, drive-by mass exploitation but not targeted social-engineering attacks against guests. Risk is meaningful for organizations running guest portals, although EPSS is low (0.53%, roughly the 43rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; treat this as a genuine high-severity issue requiring prompt patching rather than an emergency.
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specially constructed queries cause cross platform scripting leaking administrator tokens. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple SQL Injection vulnerabilities exist in the reporting application. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A user with administrator privileges is able to retrieve authentication tokens. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. No vendor patch available.
The administrator is able to configure an insecure captive portal script. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A user with administrator privileges can perform command injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A user with advanced report application access rights can perform actions for which they are not authorized. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Backup uploads to ETM subject to man-in-the-middle interception. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Specially constructed queries targeting ETM could discover active remote access sessions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to exploit a signal handler race condition by failing to authenticate within the LoginGraceTime window, potentially yielding root-level code execution on glibc-based Linux systems. The flaw - widely known as 'regreSSHion' - affects numerous distributions and vendor appliances including Ubuntu 23.10/24.04, AlmaLinux 9, SonicWall SMA firmware, Arista EOS, NetApp ONTAP, and others. Publicly available exploit code exists and EPSS scores it at 48.06% (98th percentile), reflecting very high exploitation likelihood, though it is not currently listed in CISA KEV.
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users without any password. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unprivileged users getting complete access to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible to unprivileged users in situations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in the Linux kernel 5.8.9. Rated medium severity (CVSS 5.4), this vulnerability is no authentication required.
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the kernel in NetBSD 7.1. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is. Rated low severity (CVSS 3.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. Rated high severity (CVSS 7.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded across VLAN boundaries. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (crash and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Memory corruption in the wired-uplink network endpoints of Arista Wi-Fi access points lets an unauthenticated attacker who already sits on the same Layer-2 segment as the AP's wired uplink crash the sensor service and, under specific preconditions, potentially achieve remote code execution. No authentication or user interaction is required, but the vulnerability is scored adjacent-network (AV:A) with an explicit attack precondition (AT:P in the CVSS 4.0 vector), so the dependable outcome is a denial-of-service crash of the sensor service while full code execution is condition-dependent; no public exploit code has been identified at time of analysis. Because exploitation demands Layer-2 adjacency to the uplink segment, segmentation of management/uplink VLANs is the single most effective exposure reducer.
Unauthenticated adjacent-network attackers can crash or potentially execute arbitrary code on Arista Wi-Fi access points when the packet-capture service is running in an uncommon non-default streaming mode. The flaw is a stack-based buffer overflow (CWE-121) triggered by a crafted packet to the capture service; no authentication or user interaction is required, but the attacker must have Layer-2/adjacent access and the target must already have the non-default streaming mode enabled, so default-configured devices are not exposed. No public exploit code was identified at time of analysis, and this is a conditional priority rather than a drop-everything emergency because exploitation depends on that deliberately enabled configuration.
Unauthenticated, network-adjacent attackers can crash - and potentially execute arbitrary code on - Arista Wi-Fi access points by sending a crafted packet to the wireless gateway service, provided the captive portal or application firewall feature is enabled on at least one SSID. The flaw is a stack-based buffer overflow (CWE-121) rated 9.4 under CVSS 4.0 (AV:A/AC:L/PR:N/UI:N with all impact metrics High and scope change), and because the wireless gateway service restarts automatically after a crash, an attacker can retry indefinitely. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not listed in CISA KEV); exposure is limited to devices where a vulnerable feature is actually enabled and to attackers within wireless range or on an adjacent network segment.
In Arista CV-CUE, an unauthenticated attacker can forge their apparent source IP address and obtain administrative session privileges on the CV-CUE backend, effectively bypassing authentication (CWE-290). The attacker must either be positioned on an adjacent private network segment reachable by the backend, or route requests through a reverse proxy or load balancer that forwards client-supplied headers such as X-Forwarded-For without sanitising them; no credentials and no user interaction are required. Rated CVSS 4.0 8.7 (and scored 8.7-equivalent high impact under the independent CVSS 3.1 assessment with AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H), this is a credible high-priority authentication-bypass issue. There is no public exploit identified at time of analysis, and exploitation is bounded by network reachability and header-handling configuration in front of the backend. Patch availability is not confirmed in the provided data; consult the Arista security advisory 0190.
OS command injection in Arista CloudVision CUE backup management allows an authenticated Super User to execute arbitrary commands with the privileges of the affected service by submitting a crafted backup request. Exploitation is access-gated: it requires the highest application privilege level (PR:H), so anonymous or low-privileged remote users cannot trigger it; the issue functions as an application-admin-to-OS escalation. No public exploit identified at time of analysis, and no EPSS score or KEV status was provided; the independent assessment characterizes this as a genuine but access-gated vulnerability rather than a mass-exploitation threat.
Unauthenticated network attackers can reach backend functionality in Arista CV-CUE that is intended only for internal services, giving them access to sensitive location information and the ability to disrupt affected services. The root cause is a missing authentication check (CWE-306) on internal-service endpoints, rated 9.3 under CVSS 4.0 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality, integrity and availability impact within the vulnerable component; an independent assessment agrees the flaw is remotely reachable and requires no credentials, configuration change or user interaction, but stresses that the real-world exploitability depends on network exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiting factor is whether the internal endpoints are exposed to untrusted networks or are segmented behind a trusted management network.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Authenticated users of the Arista Spectralight WiFi-server application can submit crafted XML requests that trigger external-entity resolution and disclose arbitrary local files from the server, with a secondary partial denial-of-service effect from entity processing. Exploitation requires valid credentials (CVSS 4.0 vector shows PR:L; the independent assessment concurs with PR:L) and network reach to an XML-accepting endpoint, so the realistic threat population is insiders or attackers who have already obtained an account rather than unauthenticated internet scanners. No public exploit code and no CISA KEV listing were identified at time of analysis, and the issue is rated CVSS 7.1 / CWE-611 - a moderate-severity, authentication-gated information-disclosure flaw rather than a top-tier emergency.
Stored cross-site scripting in the Arista CloudVision Fileserver upload API lets an attacker who holds a valid CloudVision account with file-upload privileges persist a malicious payload that executes in another user's browser session. Because the missing input validation allows unsanitized content to be stored and later rendered, a successful hijack of an administrator's web session can yield full account and administrative access, which is why the issue carries a 9.3 CVSS 4.0 base score; the independent assessment concurs (CVSS 3.1 8.0-class impact with S:C). Exploitation is not anonymous - it requires authenticated upload privileges (PR:L) and, critically, active interaction from a victim who must view the stored content (UI:A), so the highest-impact outcome depends on an administrator rendering the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the headline 9.3 should be read with that nuance rather than as an unauthenticated remote compromise.
Stored cross-site scripting in Arista networking software (documented in Arista Security Advisory 0192) lets an unauthenticated attacker who can reach the affected interface from an adjacent network plant malicious content that later executes in the browser of an authenticated user who views it. Exploitation requires the one-two punch of adjacent-network reachability (CVSS AV:A) plus a logged-in victim rendering the stored payload (UI:A), so the attacker gains no privileges at injection time but can hijack the victim's authenticated session, read sensitive data, alter system state, or disrupt the service once the payload fires. Arista PSIRT rates this Critical at CVSS 4.0 base 9.3, and there is no public exploit code and no indication of active exploitation (not listed in CISA KEV) at the time of analysis.
Path traversal in the Software Management Studio Software Repository (CWE-22) allows an authenticated remote user with repository-level privileges to read and write files anywhere on the underlying platform filesystem, far outside the repository's intended storage scope, by sending specially crafted requests or crafted file uploads. Successful exploitation results in complete loss of confidentiality, integrity and availability for the affected system (CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.6 with AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The decisive limiting factor is the high-privilege prerequisite (PR:H) combined with the absence of any public exploit identified at time of analysis, so realistic risk is concentrated in insider misuse or reuse of already-compromised privileged repository credentials rather than opportunistic external attack; this is a conditional priority, not a drive-by threat.
Authenticated high-privilege users on Arista EOS can exploit a path traversal (CWE-22) in the Network Provisioning Image Repository to read or write files anywhere on the platform filesystem, escaping the intended storage scope via crafted requests or malicious file uploads. The issue requires valid credentials with image-repository permissions (CVSS PR:H), so the exploit population is limited to insiders or attackers who have already compromised a privileged account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality and integrity impact makes this a mid-to-high priority for affected deployments.
Unintended data can be extracted from Arista CloudVision Sensor by authenticated high-privilege users exploiting a path traversal flaw in CloudVision Portal (on-premises) and CloudVision Sensor, though the requirement for high privileges and additional preconditions limits the risk to moderate priority. No public exploit code has been identified, and the vulnerability is not confirmed as actively exploited. The flaw primarily impacts confidentiality, with no integrity or availability impact on the vulnerable component according to the independent assessment.
Insufficient validation in the Single Sign-On (SSO) login flow of Arista CloudVision lets a remote, unauthenticated attacker craft a login URL that, once clicked by a user, causes the identity provider to send IdP-issued authentication material to an attacker-controlled URL rather than to CloudVision (CWE-601 open redirect), resulting in credential/assertion theft and potential account impersonation. The vulnerability is rated High (vendor CVSS 4.0 7.6; assessed CVSS 3.1 7.6, AV:N/AC:H/PR:N/UI:R with High confidentiality and integrity impact) and only affects deployments where CloudVision SSO is configured and in use. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on victim interaction plus specific SSO/IdP configuration and the attacker's ability to produce a redirect accepted by the deployment.
Malformed IGMP packets sent by a network-adjacent, unauthenticated attacker can terminate the IGMP snooping agent on Arista EOS switches, causing multicast traffic to flood to all ports of the affected VLAN until the agent recovers. Because IGMP snooping is enabled by default on all VLANs in EOS, most deployments are exposed out of the box, but the attacker needs Layer 2 adjacency to a target VLAN (a compromised host, rogue device, or insider on the switched segment) rather than arbitrary internet reachability, and the impact is a bounded, self-recovering availability disruption that must be repeatedly triggered to be prolonged. No public exploit code and no confirmed active exploitation were identified at time of analysis; the realistic risk is a genuine but non-critical availability concern rather than a priority-one emergency.
An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.
Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.
A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks.
Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); no EPSS score was provided. The vendor has published security advisory SA-0166 at https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166.
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched.
Authenticated command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) allows administrators with existing access to the browser management pipeline to break out and execute arbitrary terminal/shell script code on the underlying appliance OS. The flaw stems from insufficient input validation (CWE-78) within management-plane functionality and carries a CVSS 4.0 score of 7.0 with no public exploit identified at time of analysis. Because exploitation requires high-privileged authentication, the issue is a privilege-boundary breach rather than an unauthenticated remote takeover.
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) Captive Portal Custom Handler allows administrators authenticated to the management UI to execute arbitrary shell commands on the underlying platform. The CVSS 4.0 score of 7.0 reflects high privilege requirements (PR:H) offset by network reach and high confidentiality impact, with no public exploit identified at time of analysis.
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows high-privileged authenticated attackers to abuse insecure input validation in the Reports application to execute OS commands on the appliance. The flaw uniquely affects 17.4.0, with earlier releases unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score is 7.0 with confidentiality high and integrity/availability low, reflecting a scope-changing impact constrained by the high privileges required.
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows authenticated high-privileged remote attackers to inject OS commands through the Captive Portal application framework via encrypted password handling. The flaw is unique to release 17.4.0 with earlier versions unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score of 7.0 reflects high attacker privilege requirement balanced against high confidentiality impact on the firewall appliance.
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
CloudVision CUE versions 2021.2.0 through 2026.2.0 contain an insecure direct object reference (IDOR) in the file-serving interface that allows an authenticated, low-privileged network user to read another user's transient data. Exploitation is opportunistic because the victim's transient data must be present at the moment of attack, and the attacker cannot modify or delete data (confidentiality impact only, with low availability impact). No public exploit code or active exploitation has been identified at time of analysis; the vendor CVSS 4.0 base score is 6.0 (medium severity), and independent assessment concurs with a moderate triage priority.
LDAP query injection in Arista CloudVision CUE (versions 2021.2.0 through 2026.2.0) lets an unauthenticated network attacker manipulate directory-service queries when the appliance is configured to authenticate against an external LDAP directory. Exploitation is gated by high attack complexity (CVSS AC:H), meaning the attacker must land on specific conditions largely outside their control - such as a particular directory schema or query-construction path - and the resulting impact is confined to the confidentiality of the downstream directory service (scope-changed C:H), with no direct confidentiality, integrity, or availability effect on CloudVision CUE itself. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS data was not provided, and the issue should be treated as a moderate-priority hardening item rather than an emergency.
Stored cross-site scripting in Arista CloudVision CUE can let an authenticated, high-privilege administrator store malicious content in a configuration that later executes in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation could allow the attacker to act through the victim's authenticated session to access sensitive data, modify configurations, or disrupt managed wireless services. The issue is rated medium (6.2), requires high privileges and victim interaction, and no public exploit was identified at time of analysis.
Open redirect in the Arista CloudVision Portal login flow (CWE-601) lets a remote, unauthenticated attacker craft a login URL that, once a victim clicks it and completes the normal authentication process, sends that user's browser to an arbitrary external site. The issue carries a CVSS 4.0 base score of 5.3 and was assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N; the attacker needs no credentials but cannot trigger the redirect without victim interaction, and impact is limited to browser redirection with low confidentiality loss - primarily useful for enabling phishing or credential theft rather than code execution or data modification. Affected releases are CloudVision Portal 2020.3.0 through <2025.3.0, 2025.3.0 ≤2025.3.3, 2026.1.0 ≤2026.1.2, and 2026.2.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available per the Arista security advisory.
Server-side request forgery (SSRF) in Arista CloudVision Portal allows an authenticated user with high privileges to manipulate the OIDC bearer token configuration and direct requests to arbitrary destinations. Affected versions include 2023.3.0 before 2025.3.0, 2025.3.0 through 2025.3.3, 2026.1.0 through 2026.1.2, and 2026.2.0. Exploitation requires pre-existing elevated access, limiting impact to subsequent-system confidentiality; no public exploit identified at time of analysis.
Arista EOS devices configured with SNMPv3 users store the one-way hashed, localized SNMPv3 authentication key inside the running configuration and, notably, inside sanitized configuration exports, so any authenticated user who can read either artifact obtains reusable credential material for that device's SNMP engine. With that material an attacker can issue unauthorized SNMP read operations against MIB tables or inject fraudulent trap notifications into the Network Management System, though there is no configuration-write or availability impact. The vendor discovered the flaw internally, states it is unaware of malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), with exploitation gated on SNMPv3 being in use and on the attacker already holding authenticated device access or a leaked sanitized configuration.
Loose-mode Unicast Reverse Path Forwarding (uRPF) on certain Arista EOS platforms can fail to drop traffic that the configured source-address verification should have rejected, so packets that ought to be filtered are still processed and forwarded by the switch or router. Only devices running Arista EOS on one of the specific (unnamed) affected platforms and explicitly configured with loose uRPF are exposed - default deployments that do not enable uRPF are not affected, and there is no confidentiality or availability impact, only a loss of filter integrity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor CVSS score of 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) is well calibrated to this narrow, configuration-dependent filtering failure.
A crafted OSPFv2 packet delivered by an adjacent OSPF neighbor can force an unexpected restart of the OSPF process on Arista EOS devices that run both OSPFv2 and OSPFv2 segment routing, producing an availability-only denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only deployments with segment routing enabled under OSPF are exposed, since this is not a default OSPF setting, and the attacker must already be positioned on the same routing segment or link (typically a compromised or rogue device inside the OSPF domain) rather than an arbitrary internet host. No authentication or user interaction is required once adjacency is achievable, repeated packets can sustain the outage, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization results in Arista EOS gNMI (gRPC Network Management Interface) can allow an already-authenticated management user to reach resources and operations slightly beyond the permissions assigned to their role. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.2), exploitation requires the gNMI interface to be enabled and reachable plus a valid account with at least some gNMI access, and success depends on specific role/permission configurations - a high-complexity, low-impact condition rather than a remote unauthenticated bypass. There is no public exploit identified at time of analysis, no CISA KEV listing, and Arista states the issue was found internally with no known malicious use in customer networks.
Arista EOS 4.36.0 through 4.36.1F contains a race condition in IEEE 802.1X port-based Network Access Control that can leave a supplicant in an authorized state after an administrator explicitly issues the 'clear dot1x host all' deauthorization command. The flaw (CWE-459: Incomplete Cleanup) means that a device intended to be removed from the network may retain valid access, undermining the administrative action entirely. No public exploit code exists and SSVC exploitation status is confirmed as none; however, the integrity gap created - a device that should be denied access remaining authorized - is the primary concern for network access control posture.
Cross-site scripting in the Arista Edge Threat Management Next Generation Firewall web UI dashboard allows a high-privileged attacker to inject unvalidated input that is reflected back into administrative profiles, enabling script execution in the context of other administrative sessions. The vulnerability carries a CVSS 4.0 score of 5.8 (Medium), with confidentiality impact rated High on the vulnerable system - consistent with session token or credential harvesting from targeted admin accounts. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Cryptographic validation of Arista EOS software upgrade images can be bypassed when a specifically crafted file is dropped into the upgrade ISO, allowing a tampered image to be accepted as genuine because integrity checking does not fail closed. The flaw is local and operator-dependent: an attacker must already have write access to stage content on the upgrade media (PR:L) and an administrator must then actually run the upgrade from that tampered ISO (UI:R), as reflected in CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N (5.9). There is no confidentiality or availability impact - the payoff is integrity loss (I:H) with a scope change, meaning the compromised image can influence components beyond the upgrade process itself; no public exploit code has been identified at time of analysis and the EPSS score is negligible (0.09%, 0th percentile), so this is a moderate, config/operator-dependent integrity issue rather than an urgent remote-exploitation priority.
Information disclosure in Arista EOS allows authenticated low-privilege (restricted) users to view sensitive configuration database contents, including user password hashes, through a debug API. With a CVSS score of 4.3 and a low EPSS score of 0.22%, this is a moderate-risk flaw that requires a valid restricted account and is read-only in impact; no public exploit has been identified at time of analysis.
Session expiration bypass in Arista EOS allows authenticated local attackers to perform file-system operations (e.g., scp, sftp) on multiplexed SSH sessions after a configured timeout has expired, provided SSH session multiplexing is configured on the client side. Exploitation requires a low-privileged SSH user (PR:L) and local access (AV:L), and only affects specific Arista platforms; default deployments without client-side multiplexing are not exposed. No public exploit code or active exploitation has been identified, and EPSS is low (0.11%, percentile 1%).
Restricted SSH users on Arista EOS can exploit improper permission assignment (CWE-732) to use SSH port forwarding to reach host-internal services normally inaccessible to their role, enabling information disclosure and limited integrity impact. Exploitation requires an authenticated restricted account and SSH forwarding to be enabled; the assessed vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. No public exploit identified at time of analysis.
Authentication bypass in Arista's Captive Portal (CVE-2025-6979, documented as security advisory SA-0123) allows a remote, unauthenticated attacker to reach resources that the portal is supposed to protect, with high impact to confidentiality, integrity and availability (CVSS 8.8). Exposure is limited to environments where the captive portal feature is actually deployed - typically guest or onboarding access control on Arista wireless and edge infrastructure - and the assessed vector requires user interaction (UI:R), which rules out fully automated, drive-by mass exploitation but not targeted social-engineering attacks against guests. Risk is meaningful for organizations running guest portals, although EPSS is low (0.53%, roughly the 43rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; treat this as a genuine high-severity issue requiring prompt patching rather than an emergency.
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specially constructed queries cause cross platform scripting leaking administrator tokens. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple SQL Injection vulnerabilities exist in the reporting application. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A user with administrator privileges is able to retrieve authentication tokens. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. No vendor patch available.
The administrator is able to configure an insecure captive portal script. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A user with administrator privileges can perform command injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A user with advanced report application access rights can perform actions for which they are not authorized. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Backup uploads to ETM subject to man-in-the-middle interception. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Specially constructed queries targeting ETM could discover active remote access sessions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to exploit a signal handler race condition by failing to authenticate within the LoginGraceTime window, potentially yielding root-level code execution on glibc-based Linux systems. The flaw - widely known as 'regreSSHion' - affects numerous distributions and vendor appliances including Ubuntu 23.10/24.04, AlmaLinux 9, SonicWall SMA firmware, Arista EOS, NetApp ONTAP, and others. Publicly available exploit code exists and EPSS scores it at 48.06% (98th percentile), reflecting very high exploitation likelihood, though it is not currently listed in CISA KEV.
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users without any password. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unprivileged users getting complete access to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible to unprivileged users in situations. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be able to execute commands despite not having the privileges to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An issue was discovered in the Linux kernel 5.8.9. Rated medium severity (CVSS 5.4), this vulnerability is no authentication required.
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. No vendor patch available.
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the kernel in NetBSD 7.1. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is. Rated low severity (CVSS 3.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kernel crash, followed by a device reload. Rated high severity (CVSS 7.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incorrectly forwarded across VLAN boundaries. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (crash and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.