PT-2020-16461 · Arista · Arista Eos

Published 2020-12-16 · Updated 2021-01-27 · CVE-2020-26569

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Arista EOS versions 4.21.12M and below releases in the 4.21.x train Arista EOS versions 4.22.7M and below releases in the 4.22.x train Arista EOS versions 4.23.5M and below releases in the 4.23.x train Arista EOS versions 4.24.2F and below releases in the 4.24.x train

Description In EVPN VxLAN setups, specific malformed packets can lead to incorrect MAC to IP bindings, resulting in packets being incorrectly forwarded across VLAN boundaries. This can cause traffic to be discarded on the receiving VLAN. The issue was discovered internally, and there is no awareness of any malicious uses of this issue in customer networks.

Recommendations For versions 4.21.12M and below in the 4.21.x train, update to a version above 4.21.12M. For versions 4.22.7M and below in the 4.22.x train, update to a version above 4.22.7M. For versions 4.23.5M and below in the 4.23.x train, update to a version above 4.23.5M. For versions 4.24.2F and below in the 4.24.x train, update to a version above 4.24.2F.

Exploit

Fix

Related Identifiers

CVE-2020-26569

Affected Products

Arista Eos

References · 5

• 🔥 https://arista.com/en/support/advisories-notices/security-advisories/11997-security-advisory-57 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26569 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26569 · Vendor Advisory
• https://t.me/cibsecurity/21356 · Telegram Post
• https://t.me/cvenotify/8190 · Telegram Post