mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-30 18:04:30 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
4a8ce1c4f8
commit
48a69e9a58
@ -1,17 +1,17 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-21150",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "secure@intel.com",
|
||||
"STATE": "REJECT"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,150 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-11185",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@arista.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "cwe-1189"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Arista Networks",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "EOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4.29.0",
|
||||
"version_value": "4.29.10M"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4.30.0",
|
||||
"version_value": "4.30.9M"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4.31.0",
|
||||
"version_value": "4.31.6M"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4.32.0",
|
||||
"version_value": "4.32.3M"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4.33.0",
|
||||
"version_value": "4.33.1F"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://https://www.arista.com/en/support/advisories-notices/security-advisory/21411-security-advisory-0118",
|
||||
"refsource": "MISC",
|
||||
"name": "https://https://www.arista.com/en/support/advisories-notices/security-advisory/21411-security-advisory-0118"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SA118",
|
||||
"defect": [
|
||||
"BUG1009562"
|
||||
],
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"configuration": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<b><p><span style=\"background-color: transparent;\">In order to be vulnerable to CVE-2024-11185, the following condition must be met:</span></p><br><p><span style=\"background-color: transparent;\">IPV4 or IPV6 routing must be enabled. :</span></p><div><table><tbody><tr><td><p><span style=\"background-color: rgb(183, 183, 183);\">s</span><span style=\"background-color: rgb(204, 204, 204);\">witch>show vrf</span></p><p><span style=\"background-color: rgb(204, 204, 204);\">Maximum number of VRFs allowed: 1023</span></p><p><span style=\"background-color: rgb(204, 204, 204);\"> VRF Protocols State Interfaces</span></p><p><span style=\"background-color: rgb(204, 204, 204);\">------------- --------------- ---------------- ----------</span></p><p><span style=\"background-color: rgb(204, 204, 204);\"> default IPv4 routing Ma1 </span></p><p><span style=\"background-color: rgb(204, 204, 204);\"> default IPv6 routing Ma1 </span></p><p><span style=\"background-color: rgb(204, 204, 204);\"> </span><span style=\"background-color: rgb(183, 183, 183);\"> </span><span style=\"background-color: rgb(255, 255, 255);\"> </span></p></td></tr></tbody></table></div></b><br>"
|
||||
}
|
||||
],
|
||||
"value": "In order to be vulnerable to CVE-2024-11185, the following condition must be met:\n\n\nIPV4 or IPV6 routing must be enabled. :\n\nswitch>show vrf\n\nMaximum number of VRFs allowed: 1023\n\n\u00a0 \u00a0VRF \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Protocols \u00a0 \u00a0 \u00a0 State \u00a0 \u00a0 \u00a0 \u00a0 Interfaces\n\n------------- --------------- ---------------- ----------\n\n\u00a0 \u00a0default \u00a0 \u00a0 \u00a0 IPv4 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 routing \u00a0 Ma1 \u00a0 \u00a0 \u00a0 \n\n\u00a0 \u00a0default \u00a0 \u00a0 \u00a0 IPv6 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 routing \u00a0 Ma1"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<b><span style=\"background-color: rgb(255, 255, 255);\">There are no workarounds.</span></b><br>"
|
||||
}
|
||||
],
|
||||
"value": "There are no workarounds."
|
||||
}
|
||||
],
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<b><p><span style=\"background-color: transparent;\">The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\"><span style=\"background-color: transparent;\">EOS User Manual: Upgrades and Downgrades</span></a></p><br><p><span style=\"background-color: transparent;\">CVE-2024-11185 has been fixed in the following releases:</span></p><ul><li><p><span style=\"background-color: transparent;\">4.30.10M and later releases in the 4.30.x train</span></p></li><li><p><span style=\"background-color: transparent;\">4.31.7M and later releases in the 4.31.x train</span></p></li><li><p><span style=\"background-color: transparent;\">4.32.5M and later releases in the 4.32.x train</span></p></li><li><p><span style=\"background-color: transparent;\">4.33.2F and later releases in the 4.33.x train</span></p></li></ul></b><br>"
|
||||
}
|
||||
],
|
||||
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\n\nCVE-2024-11185 has been fixed in the following releases:\n\n * 4.30.10M and later releases in the 4.30.x train\n\n\n * 4.31.7M and later releases in the 4.31.x train\n\n\n * 4.32.5M and later releases in the 4.32.x train\n\n\n * 4.33.2F and later releases in the 4.33.x train"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,104 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-45094",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@us.ibm.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "IBM DS8900F and DS8A00 Hardware Management Console (HMC)\u00a0is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "IBM",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Hardware Management Console",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "DS8900F"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "DS8A00"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7234276",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.ibm.com/support/pages/node/7234276"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "DS8A00 fixes are delivered in Microcode Bundle 10.2.35.0 R10.0 SP2<br>DS8900F fixes are delivered in Microcode Bundle 89.43.3.0 R9.4 SP3<br>"
|
||||
}
|
||||
],
|
||||
"value": "DS8A00 fixes are delivered in Microcode Bundle 10.2.35.0 R10.0 SP2\nDS8900F fixes are delivered in Microcode Bundle 89.43.3.0 R9.4 SP3"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,130 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-2796",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@arista.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal anti-replay protection, will instead be forwarded due to this vulnerability.\n\nNote: this issue does not affect VXLANSec or MACSec encryption functionality."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "cwe-284"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Arista Networks",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "EOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "4.33.0",
|
||||
"version_value": "4.33.2F"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21413-security-advisory-0119",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.arista.com/en/support/advisories-notices/security-advisory/21413-security-advisory-0119"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SA119",
|
||||
"defect": [
|
||||
"BUG1073719"
|
||||
],
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"configuration": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<p>In order to be vulnerable to CVE-2025-2796, the following condition must be met:</p><p><b>anti-replay detection</b> must be configured in IPSec SA Policy:</p><pre>switch(config)# ip security\nswitch(config-ipsec)# sa policy sa1\nswitch(config-ipsec-sa1)# anti-replay detection</pre><br>"
|
||||
}
|
||||
],
|
||||
"value": "In order to be vulnerable to CVE-2025-2796, the following condition must be met:\n\nanti-replay detection\u00a0must be configured in IPSec SA Policy:\n\nswitch(config)# ip security\nswitch(config-ipsec)# sa policy sa1\nswitch(config-ipsec-sa1)# anti-replay detection"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<span style=\"background-color: rgb(255, 255, 255);\">There is no known mitigation for CVE-2025-2796. The recommended resolution is to upgrade to a remediated software version at your earliest convenience.</span><br>"
|
||||
}
|
||||
],
|
||||
"value": "There is no known mitigation for CVE-2025-2796. The recommended resolution is to upgrade to a remediated software version at your earliest convenience."
|
||||
}
|
||||
],
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><div>CVE-2025-2796 has been fixed in the following releases:</div><ul><li>4.33.3M and later releases in the 4.33.x train</li></ul>"
|
||||
}
|
||||
],
|
||||
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2025-2796 has been fixed in the following releases:\n\n * 4.33.3M and later releases in the 4.33.x train"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,130 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2025-2826",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@arista.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to incorrectly be allowed or denied. The two symptoms of this issue on the affected release and platform are:\n\n * Packets which should be permitted may be dropped and,\n * Packets which should be dropped may be permitted."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-1284 Improper Validation of Specified Quantity in Input",
|
||||
"cweId": "CWE-1284"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Arista Networks",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "EOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "4.33.2F"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21414-security-advisory-0120",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.arista.com/en/support/advisories-notices/security-advisory/21414-security-advisory-0120"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SA120",
|
||||
"defect": [
|
||||
"BUG 795398"
|
||||
],
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"configuration": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<p>In order to be vulnerable to CVE-2025-2826, the following condition must be met: IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL must be configured and active on more than one Ethernet interfaces or one or more LAG interfaces. The output of CLI show commands will look similar to the following:</p><pre>switch> show ip access-lists summary\nPhone ACL bypass: disabled\nIPV4 ACL default-control-plane-acl [readonly]\n Total rules configured: 27\n Configured on Ingress: control-plane(default VRF)\n Active on Ingress: control-plane(default VRF)\n \n<span style=\"background-color: rgb(255, 255, 0);\">IPV4 ACL ipv4ACL</span>\n Total rules configured: 2\n Configured on Ingress: Et18/1\n <span style=\"background-color: rgb(255, 255, 0);\">Active on Ingress:</span> Et18/1\n</pre><div> </div><p>or</p><pre>switch>show mac access-lists summary\n<span style=\"background-color: rgb(255, 255, 0);\">MAC ACL macAcl</span>\n Total rules configured: 2\n Configured on Ingress: Et18/1\n <span style=\"background-color: rgb(255, 255, 0);\">Active on Ingress:</span> Et18/1\n</pre><div> </div><p>or</p><pre>switch>show ipv6 access-lists summary\nPhone ACL bypass: disabled\nIPV6 ACL default-control-plane-acl [readonly]\n Total rules configured: 27\n Configured on Ingress: control-plane(default VRF)\n Active on Ingress: control-plane(default VRF)\n \n<span style=\"background-color: rgb(255, 255, 0);\">Standard IPV6 ACL ipv6StandardACL</span>\n Total rules configured: 2\n Configured on Ingress: Et21/1\n <span style=\"background-color: rgb(255, 255, 0);\">Active on Ingress:</span> Et21/1\n</pre><div> </div><p>If IPv4 Ingress ACL or MAC Ingress ACL or IPv6 standard Ingress ACL are not configured or are not active on any Ethernet interface or LAG interfaces there is no exposure to this issue and the CLI show command output have no active interfaces\u02dc listed, similar to the following:</p><pre>switch> show ip access-lists summary\nPhone ACL bypass: disabled\nIPV4 ACL default-control-plane-acl [readonly]\n Total rules configured: 27\n Configured on Ingress: control-plane(default VRF)\n Active on Ingress: control-plane(default VRF)\n</pre><div> </div><p>or</p><pre>switch>show mac access-lists summary\n</pre><div> </div><p>or</p><pre>switch>show ipv6 access-lists summary\nPhone ACL bypass: disabled\nIPV6 ACL default-control-plane-acl [readonly]\n Total rules configured: 27\n Configured on Ingress: control-plane(default VRF)\n Active on Ingress: control-plane(default VRF)\n</pre><br><br>"
|
||||
}
|
||||
],
|
||||
"value": "In order to be vulnerable to CVE-2025-2826, the following condition must be met: IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL must be configured and active on more than one Ethernet interfaces or one or more LAG interfaces. The output of CLI show commands will look similar to the following:\n\nswitch> show ip access-lists summary\nPhone ACL bypass: disabled\nIPV4 ACL default-control-plane-acl [readonly]\n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 27\n\u00a0 \u00a0 \u00a0 \u00a0 Configured on Ingress: control-plane(default VRF)\n\u00a0 \u00a0 \u00a0 \u00a0 Active on \u00a0 \u00a0 Ingress: control-plane(default VRF)\n \nIPV4 ACL ipv4ACL\n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 2\n\u00a0 \u00a0 \u00a0 \u00a0 Configured on Ingress: Et18/1\n\u00a0 \u00a0 \u00a0 \u00a0 Active on \u00a0 \u00a0 Ingress: Et18/1\n\n\n\u00a0\n\nor\n\nswitch>show mac access-lists summary\nMAC ACL macAcl\n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 2\n\u00a0 \u00a0 \u00a0 \u00a0 Configured on Ingress: Et18/1\n\u00a0 \u00a0 \u00a0 \u00a0 Active on \u00a0 \u00a0 Ingress: Et18/1\n\n\n\u00a0\n\nor\n\nswitch>show ipv6 access-lists summary\nPhone ACL bypass: disabled\nIPV6 ACL default-control-plane-acl [readonly]\n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 27\n\u00a0 \u00a0 \u00a0 \u00a0 Configured on Ingress: control-plane(default VRF)\n\u00a0 \u00a0 \u00a0 \u00a0 Active on \u00a0 \u00a0 Ingress: control-plane(default VRF)\n \nStandard IPV6 ACL ipv6StandardACL\n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 2\n\u00a0 \u00a0 \u00a0 \u00a0 Configured on Ingress: Et21/1\n\u00a0 \u00a0 \u00a0 \u00a0 Active on \u00a0 \u00a0 Ingress: Et21/1\n\n\n\u00a0\n\nIf IPv4 Ingress ACL or MAC Ingress ACL or IPv6 standard Ingress ACL are not configured or are not active on any Ethernet interface or LAG interfaces there is no exposure to this issue and the CLI show command output have no active interfaces\u02dc listed, similar to the following:\n\nswitch> show ip access-lists summary\nPhone ACL bypass: disabled\nIPV4 ACL default-control-plane-acl [readonly]\n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 27\n\u00a0 \u00a0 \u00a0 \u00a0 Configured on Ingress: control-plane(default VRF)\n\u00a0 \u00a0 \u00a0 \u00a0 Active on \u00a0 \u00a0 Ingress: control-plane(default VRF)\n\n\n\u00a0\n\nor\n\nswitch>show mac access-lists summary\n\n\n\u00a0\n\nor\n\nswitch>show ipv6 access-lists summary\nPhone ACL bypass: disabled\nIPV6 ACL default-control-plane-acl [readonly]\n\u00a0 \u00a0 \u00a0 \u00a0 Total rules configured: 27\n\u00a0 \u00a0 \u00a0 \u00a0 Configured on Ingress: control-plane(default VRF)\n\u00a0 \u00a0 \u00a0 \u00a0 Active on \u00a0 \u00a0 Ingress: control-plane(default VRF)"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<span style=\"background-color: rgb(255, 255, 255);\">No workaround is available. Ingress ACLs may be applied as egress, if resources permit and the policy is applicable.</span><br>"
|
||||
}
|
||||
],
|
||||
"value": "No workaround is available. Ingress ACLs may be applied as egress, if resources permit and the policy is applicable."
|
||||
}
|
||||
],
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><p>CVE-2025-2826 has been fixed in the following releases:</p><ul><li>4.33.2.1F, 4.33.3F and later releases in the 4.33.x train</li></ul>"
|
||||
}
|
||||
],
|
||||
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2025-2826 has been fixed in the following releases:\n\n * 4.33.2.1F, 4.33.3F and later releases in the 4.33.x train"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 2.6,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user