Vulnerability · Published Apr 12, 2023 · Assigned by Arista
CVE-2023-24511On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.
Medium 5.3
In plain English
A medium-severity memory leak in EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Official description
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | EOS | 4.28.0 4.28.5.1M4.27.0 4.27.8.1M4.26.0 4.26.9M4.25.0 4.25.10M4.24.0 4.24.11M4.29.0 – through 4.29.1F |
Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L