CVE-2024-5872

On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/20649-security-advisory-0106

Configurations

No configuration.

History

No history.

Information

Published : 2025-01-10 21:15

Updated : 2026-06-17 08:16

NVD link : CVE-2024-5872

Mitre link : CVE-2024-5872

CVE.ORG link : CVE-2024-5872

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-5872", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-5872", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T21:11:13.257737Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@arista.com", "affectedData": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.32.0F", "versionType": "custom", "lessThanOrEqual": "4.32.2F"}, {"status": "affected", "version": "4.31.0M", "versionType": "custom", "lessThanOrEqual": "4.31.4M"}, {"status": "affected", "version": "4.30.0M", "versionType": "custom", "lessThanOrEqual": "4.30.7M"}, {"status": "affected", "version": "4.29.0M", "versionType": "custom", "lessThanOrEqual": "4.29.8M"}, {"status": "affected", "version": "4.28.1F", "versionType": "custom", "lessThanOrEqual": "4.28.11F"}], "defaultStatus": "unaffected"}]}], "published": "2025-01-10T21:15:13.367", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/20649-security-advisory-0106", "source": "psirt@arista.com"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc."}, {"lang": "es", "value": "En las plataformas afectadas que ejecutan Arista EOS, es posible que se copie en la CPU un paquete especialmente manipulado con una etiqueta VLAN incorrecta, lo que puede provocar un comportamiento incorrecto del plano de control relacionado con el paquete, como fluctuaciones de ruta, rutas de multidifusi\u00f3n aprendidas, etc."}], "lastModified": "2026-06-17T08:16:49.387", "sourceIdentifier": "psirt@arista.com"}