Vulnerability · Published Aug 29, 2023 · Assigned by Arista
CVE-2023-24548On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packets
Medium 5.3
In plain English
A medium-severity buffer overflow in EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packets. The device will continue to be susceptible to the issue until remediation is in place.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | EOS | 4.25.0F – through =4.25.0F4.24.0 – through <=4.24.11M4.23.0 – through <=4.23.14M4.22.1F – through <=4.22.13M |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H