CVE-2020-26146

kernel: reassembling encrypted fragments with non-consecutive packet numbers

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.

CVSS 3.1 · 5.3 Medium EPSS 5.6% KEV · Not listed

Vendors

Arista Redhat Samsung and 1 more

Products

C-100 C-100 Firmware C-110 and 36 more

CVE-2021-28511

This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches t ...

This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet flow. This could allow a host with an IP address in a range that matches the range allowed by a NAT ACL and a range denied by a Security ACL to be forwarded incorrectly as it should have been denied by the Security ACL. This can enable an ACL bypass.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

7050cx3-32s 7050cx3m-32s 7050sx3-48c8 and 13 more

CVE-2022-29071

This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vu ...

This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords might be leaked to other authenticated users.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2014-6271

bash: specially-crafted environment variables can be used to inject shell commands

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed

Vendors

Apple Arista Canonical and 14 more

Products

Mac Os X Eos Ubuntu Linux and 87 more

CVE-2014-7169

bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Listed

Vendors

Apple Arista Canonical and 14 more

Products

Mac Os X Eos Ubuntu Linux and 87 more

CVE-2025-54549

Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO

Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Danz Monitoring Fabric

CVE-2025-54548

On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)

On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Danz Monitoring Fabric

CVE-2025-54545

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Danz Monitoring Fabric

CVE-2025-6978

Diagnostics command injection vulnerability

Diagnostics command injection vulnerability

CVSS 3.1 · 7.2 High EPSS 14.1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2025-1260

On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.

On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2025-0505

On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state

On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2024-9448

On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropp

On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2025-8870

On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.

On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2025-8872

A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted

On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted. This may cause disruption in the OSFPv3 routes on the switch. This issue was discovered internally by Arista and is not aware of any malicious uses of this issue in customer networks.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2025-7048

On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption o

On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption of dataplane traffic.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2025-6980

Captive Portal can expose sensitive information

Captive Portal can expose sensitive information

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2025-6979

Captive Portal can allow authentication bypass

Captive Portal can allow authentication bypass

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2025-6188

On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do n

On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do not perform some form of authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2025-54546

On affected platforms, restricted users could use SSH port forwarding to access host-internal services

On affected platforms, restricted users could use SSH port forwarding to access host-internal services

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Danz Monitoring Fabric

CVE-2025-54547

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Danz Monitoring Fabric