Arista networks Latest High Vulnerabilities

Traffic Policy Misconfiguration in Arista EOS Network Infrastructure

CVE-2024-9448

Arista NetworksEos7.5HIGH

Cleartext Packet Transmission in Arista EOS with Secure Vxlan Configuration

CVE-2024-12378

Arista NetworksCloudvision Portal9.1CRITICAL

Improper Access Control in Arista CloudVision Portal

CVE-2024-11186

Arista NetworksCloudvision Portal10CRITICAL

Privilege Escalation Vulnerability in Arista CloudVision Systems

CVE-2025-0505

Arista NetworksCloudvision Portal10CRITICAL

Admin Privilege Escalation Vulnerability in Arista CloudVision Portal

CVE-2024-8100

Arista NetworksCloudvision8.7HIGH

Configuration Bypass Vulnerability in Arista EOS Network Switch by Arista Networks

CVE-2025-1260

Arista NetworksEos9.1CRITICAL

Data Exposure Vulnerability in Arista EOS with OpenConfig Configuration

CVE-2025-1259

Arista NetworksEos7.7HIGH

Command Injection Vulnerability in Arista NG Firewall

CVE-2024-12829

Arista NetworksNg Firewall8.8HIGH

Directory Traversal Remote Code Execution Flaw in Arista NG Firewall

CVE-2024-12830

Arista NetworksNg Firewall7.3HIGH

Privilege Escalation Vulnerability in Arista NG Firewall

CVE-2024-12831

Arista NetworksNg Firewall7.8HIGH

Arista NG Firewall (NGFW) Vulnerable to SQL Injection Attacks

CVE-2024-27889

Arista NetworksArista Edge Threat Man...8.8HIGH

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

CVE-2023-24510

Arista NetworksArista Eos7.5HIGH

On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.

CVE-2023-24512

Arista NetworksTerminattr8.8HIGH

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...

CVE-2023-24509

Arista NetworksArista Eos9.3CRITICAL

On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch.

CVE-2023-24545

Arista NetworksEos7.5HIGH

On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

CVE-2021-28505

Arista NetworksEos7.5HIGH

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...

CVE-2021-28504

Arista NetworksEos7.5HIGH

In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

CVE-2021-28503

Arista NetworksArista Eos7.4HIGH

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

CVE-2021-28500

Arista NetworksArista Eos9.1CRITICAL

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

CVE-2021-28501

Arista NetworksTerminattr9.1CRITICAL

An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.

CVE-2021-28506

Arista NetworksEos9.1CRITICAL

arista networks Latest High & Critical Vulnerabilities

Vulnerability Published:

Sort By:

8 May 2025

Traffic Policy Misconfiguration in Arista EOS Network Infrastructure

Cleartext Packet Transmission in Arista EOS with Secure Vxlan Configuration

Improper Access Control in Arista CloudVision Portal

Privilege Escalation Vulnerability in Arista CloudVision Systems

Admin Privilege Escalation Vulnerability in Arista CloudVision Portal

4 March 2025

Configuration Bypass Vulnerability in Arista EOS Network Switch by Arista Networks

Data Exposure Vulnerability in Arista EOS with OpenConfig Configuration

20 December 2024

Command Injection Vulnerability in Arista NG Firewall

Directory Traversal Remote Code Execution Flaw in Arista NG Firewall

Privilege Escalation Vulnerability in Arista NG Firewall

4 March 2024

Arista NG Firewall (NGFW) Vulnerable to SQL Injection Attacks

5 June 2023

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

25 April 2023

On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.

13 April 2023

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...

12 April 2023

On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch.

14 April 2022

On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

1 April 2022

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...

4 February 2022

In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

14 January 2022

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.