Vulnerability · Published Jan 10, 2025 · Assigned by Arista
CVE-2024-5872On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.
Medium 6.5
In plain English
A medium-severity security flaw in EOS from Arista Networks. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 69.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | EOS | 4.32.0F – through 4.32.2F4.31.0M – through 4.31.4M4.30.0M – through 4.30.7M4.29.0M – through 4.29.8M4.28.1F – through 4.28.11F |