CVE-2023-24511: arista eos

csirt@kutim:~/threat-intel/cve/CVE-2023-24511

CVSS 7.5 · High EPSS 0,84%

Kerentanan Missing Release of Memory after Effective Lifetime pada arista eos. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.

Rincian

Terbit di NVD: 12 April 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-401: Missing Release of Memory after Effective Lifetime
EPSS (30 hari): 0,84% peluang dieksploitasi; lebih tinggi dari 56,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
arista	eos	Versi 4.26.0 hingga sebelum 4.26.10m
arista	eos	Versi 4.27.0 hingga sebelum 4.27.9m
arista	eos	Versi 4.28.0 hingga sebelum 4.28.6m
arista	eos	Versi 4.29.0 hingga sebelum 4.29.2f

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.arista.com/en/support/advisories-notices/security-advisory/17239-security-advisory-0084 exploit · patch · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.