Arista Networks vulnerabilities
We track 81 vulnerabilities in Arista Networks products across 19 products. 80 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Arista Networks vulnerabilities
- 7.5 High severity
EOS: Improper Limitation of a Pathname to a Restricted Directory
On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.
- 8.6 High severity
EOS: Allocation of Resources Without Limits or Throttling
On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system.
- 8.6 High severity
EOS: Out-of-bounds Write
On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a spec
- 9.6 Critical severity
EOS: Expected Behavior Violation
On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated atta
- 8.6 High severity
EOS: Improper Validation of Specified Quantity in Input
On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device r
- 8.2 High severity
EOS: Out-of-bounds Read
A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.
- 8.2 High severity
EOS: Incorrect Behavior Order
A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.
- 8.2 High severity
EOS: Unprotected Alternate Channel
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.
- 9.8 Critical severity
EOS: Stack-based Buffer Overflow
On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and p
- 8.1 High severity
EOS: Incorrect Implementation of Authentication Algorithm
An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An
- 8.8 High severity
EOS: Buffer Underwrite
An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on
- 7.6 High severity
EOS: Improper Access Control
On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This coul
- 7.5 High severity
EOS: Expected Behavior Violation
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets
- 8.1 High severity
EOS: Improper Validation of Unsafe Equivalence in Input
This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attack
- 8.2 High severity
EOS: Reliance on Untrusted Inputs in a Security Decision
On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potential
- 8.8 High severity
Wi-Fi Access Point: Use of Hard-coded Credentials
Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification
- 9.9 Critical severity
Arista VeloCloud Orchestrator SQL Injection Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
- 7.5 High severity
Wi-Fi Access Points: Stack-based Buffer Overflow
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the
- 7.5 High severity
Wi-Fi Access Points: Stack-based Buffer Overflow
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-de
- 8.8 High severity
Wi-Fi Access Points: Out-of-bounds Write
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or
- 8.8 High severity
Wi-Fi Access Points: Stack-based Buffer Overflow
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a
- 8.8 High severity
CloudVision CUE: Authentication Bypass by Spoofing
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
- 7.2 High severity
CloudVision CUE: Improper Neutralization of Special Elements used in an OS Command
An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.
- 9.8 Critical severity
CloudVision CUE: Missing Authentication for Critical Functionality
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
- 8.5 High severity
CloudVision CUE: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.
- 8.4 High severity
CloudVision Portal: Improper Neutralization of Input During Web Page Generation
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision use
- 8.7 High severity
CloudVision CUE: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to
- 8.4 High severity
CloudVision CUE: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affec
- 9.1 Critical severity
CloudVision Portal: Improper Limitation of a Pathname to a Restricted Directory
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.
- 7.2 High severity
CloudVision Portal: Improper Limitation of a Pathname to a Restricted Directory
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.
- 8.0 High severity
CloudVision Portal: Improper Limitation of a Pathname to a Restricted Directory
On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.
- 8.0 High severity
CloudVision Portal: URL Redirection to Untrusted Site
Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL inste
- 10.0 Critical severity
Arista VeloCloud Orchestrator Improper Input Validation Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
- 10.0 Critical severity
EOS: Improper Control of Generation of Code
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full adminis
- 9.6 Critical severity
VeloCloud Edge: Missing Authentication for Critical Functionality
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
- 7.5 High severity
EOS: Improper Handling of Length Parameter Inconsistency
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
- 10.0 Critical severity
EOS: Improper Control of Generation of Code
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default
- 8.2 High severity
EOS: Insufficient Verification of Data Authenticity
On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency fl
- 8.8 High severity
EOS: Improper Control of Generation of Code
On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root pr
- 8.0 High severity
EOS: Incorrect Privilege Assignment
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-