An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.
CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.
In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. This leads to either a Sysdb agent crash on the EOS device causing a soft reset of the switch or agent crashes on the CVX server causing instability of the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to already have a high privilege access to the connected device to be able to send custom TCP packets. EOS switches that are not connected to a CVX server are not impacted.
A vulnerability in Arista Networks EOS with IPsec configured allows a specially crafted packet to cause the dataplane to stop processing all IPsec traffic. The control plane may detect this and attempt a reset, but traffic may not resume. Non-IPsec traffic and IPsec traffic not originating or terminating on the system are unaffected. This issue affects specific EOS versions and was reported by a customer.
CVE-2024-27892 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.24.0 through 4.31.0. It involves missing authentication for a critical function where a gNMI Set request can be executed despite it being expected to be rejected. This flaw can lead to unexpected configuration changes on the affected switches.
CVE-2024-27890 is a vulnerability in Arista Networks EOS affecting versions 4.24.0 through 4.29.0 where a gNMI Set request can be executed without proper authentication when OpenConfig is configured. This allows unauthorized configuration changes on the switch. The vulnerability is rated high severity with a CVSS 4.0 score of 7.2. No official patch or remediation guidance is currently provided by the vendor.
CVE-2024-27891 is a medium severity vulnerability in Arista Networks EOS where ACL policies may not be enforced on egressing packets if MACsec and egress ACLs are configured on the same interfaces. This improper access control can cause packets to be incorrectly allowed or denied when leaving the affected ports.
CVE-2024-6858 is a medium severity vulnerability in Arista Networks EOS affecting versions 4.28.10, 4.29.0, 4.30.0, and 4.31.0. When operating in 802.1X mode, multi-authentication unauthenticated hosts might gain access to a switch port if an EAPOL capable device exists in the fallback VLAN. This improper validation of input type could lead to unauthorized network access. No official patch or remediation guidance has been provided yet.
On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption of dataplane traffic.
On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted. This may cause disruption in the OSFPv3 routes on the switch.
This issue was discovered internally by Arista and is not aware of any malicious uses of this issue in customer networks.
On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do not perform some form of authentication.
