CVE-2023-24548

Exploit

EPSS 0.05%
Published 29.08.2023 17:15:11
Last modified 21.11.2024 07:48:06
Source psirt@arista.com
Teams watchlist Login
Open Login

On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packets. The device will continue to be susceptible to the issue until remediation is in place.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Arista ≫ Eos Version >= 4.22.1f <= 4.22.13m

   Arista ≫ 7280cr3-32d4 Version-
   Arista ≫ 7280cr3-32p4 Version-
   Arista ≫ 7280cr3-36s Version-
   Arista ≫ 7280cr3-96 Version-
   Arista ≫ 7280cr3a-24d12 Version-
   Arista ≫ 7280cr3a-48d6 Version-
   Arista ≫ 7280cr3a-72 Version-
   Arista ≫ 7280dr3-24 Version-
   Arista ≫ 7280dr3a-36 Version-
   Arista ≫ 7280dr3a-54 Version-
   Arista ≫ 7280dr3ak-36 Version-
   Arista ≫ 7280dr3ak-54 Version-
   Arista ≫ 7280dr3am-36 Version-
   Arista ≫ 7280dr3am-54 Version-
   Arista ≫ 7280pr3-24 Version-
   Arista ≫ 7280r3 Version-
   Arista ≫ 7280sr3-40yc6 Version-
   Arista ≫ 7280sr3-48yc8 Version-
   Arista ≫ 7280tr3-40c6 Version-
   Arista ≫ 7500r3-24d Version-
   Arista ≫ 7500r3-24p Version-
   Arista ≫ 7500r3-36cq Version-
   Arista ≫ 7500r3k-36cq Version-
   Arista ≫ 7500r3k-48y4d Version-
   Arista ≫ 7504r3 Version-
   Arista ≫ 7508r3 Version-
   Arista ≫ 7512r3 Version-
   Arista ≫ 7800r3-36d Version-
   Arista ≫ 7800r3-36p Version-
   Arista ≫ 7800r3-48cq Version-
   Arista ≫ 7800r3a-36d Version-
   Arista ≫ 7800r3a-36dm Version-
   Arista ≫ 7800r3a-36p Version-
   Arista ≫ 7800r3a-36pm Version-
   Arista ≫ 7800r3ak-36dm Version-
   Arista ≫ 7800r3ak-36pm Version-
   Arista ≫ 7800r3k-36dm Version-
   Arista ≫ 7800r3k-48cq Version-
   Arista ≫ 7800r3k-48cqms Version-
   Arista ≫ 7800r3k-72y7512r3 Version-
   Arista ≫ 7808r3 Version-
   Arista ≫ 7812r3 Version-
   Arista ≫ 7816r3 Version-

Arista ≫ Eos Version >= 4.23.0 <= 4.23.14m

Arista ≫ Eos Version >= 4.24.0 <= 4.24.11m

Arista ≫ Eos Version4.25.0f

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.05%	0.169

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
psirt@arista.com	5.3	1.6	3.6	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

https://www.arista.com/en/support/advisories-notices/security-advisory/18043-security-advisory-0089

Vendor Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2023-24548

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-24548

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-24548

EUVD