CVE-2020-15898

In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56	Exploit Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:arista:7170-32c:-:::::::*
	cpe:2.3:h:arista:7170-32cd:-:::::::*
	cpe:2.3:h:arista:7170-64c:-:::::::*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:arista:eos::::::::
	cpe:2.3:o:arista:eos::::::::
	cpe:2.3:o:arista:eos::::::::
	cpe:2.3:o:arista:eos::::::::

OR	cpe:2.3:h:arista:7050cx3-32s:-:::::::*
	cpe:2.3:h:arista:7050cx3m-32s:-:::::::*
	cpe:2.3:h:arista:7050qx-32s:-:::::::*
	cpe:2.3:h:arista:7050qx2-32s:-:::::::*
	cpe:2.3:h:arista:7050sx-128:-:::::::*
	cpe:2.3:h:arista:7050sx-64:-:::::::*
	cpe:2.3:h:arista:7050sx-72q:-:::::::*
	cpe:2.3:h:arista:7050sx2-128:-:::::::*
	cpe:2.3:h:arista:7050sx2-72q:-:::::::*
	cpe:2.3:h:arista:7050sx3-48c8:-:::::::*
	cpe:2.3:h:arista:7050sx3-48yc:-:::::::*
	cpe:2.3:h:arista:7050sx3-48yc12:-:::::::*
	cpe:2.3:h:arista:7050sx3-48yc8:-:::::::*
	cpe:2.3:h:arista:7050sx3-96yc8:-:::::::*
	cpe:2.3:h:arista:7050tx-48:-:::::::*
	cpe:2.3:h:arista:7050tx-64:-:::::::*
	cpe:2.3:h:arista:7050tx-72q:-:::::::*
	cpe:2.3:h:arista:7050tx2-128:-:::::::*
	cpe:2.3:h:arista:7050tx3-48c8:-:::::::*
	cpe:2.3:h:arista:7060cx-32s:-:::::::*
	cpe:2.3:h:arista:7060cx2-32s:-:::::::*
	cpe:2.3:h:arista:7060dx4-32:-:::::::*
	cpe:2.3:h:arista:7060px4-32:-:::::::*
	cpe:2.3:h:arista:7060sx2-48yc6:-:::::::*
	cpe:2.3:h:arista:720xp-24y6:-:::::::*
	cpe:2.3:h:arista:720xp-24zy4:-:::::::*
	cpe:2.3:h:arista:720xp-48y6:-:::::::*
	cpe:2.3:h:arista:720xp-48zc2:-:::::::*
	cpe:2.3:h:arista:720xp-96zc2:-:::::::*
	cpe:2.3:h:arista:7250qx-64:-:::::::*
	cpe:2.3:h:arista:7260cx:-:::::::*
	cpe:2.3:h:arista:7260cx3:-:::::::*
	cpe:2.3:h:arista:7260cx3-64:-:::::::*
	cpe:2.3:h:arista:7260qx:-:::::::*
	cpe:2.3:h:arista:7300x-32q:-:::::::*
	cpe:2.3:h:arista:7300x-64s:-:::::::*
	cpe:2.3:h:arista:7300x-64t:-:::::::*
	cpe:2.3:h:arista:7300x3-32c:-:::::::*
	cpe:2.3:h:arista:7300x3-48yc4:-:::::::*
	cpe:2.3:h:arista:7304x3:-:::::::*
	cpe:2.3:h:arista:7308x3:-:::::::*
	cpe:2.3:h:arista:7320x-32c:-:::::::*
	cpe:2.3:h:arista:7324x:-:::::::*
	cpe:2.3:h:arista:7328x:-:::::::*
	cpe:2.3:h:arista:7368x4:-:::::::*

History

21 Nov 2024, 05:06

Type	Values Removed	Values Added
References	~~() https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56 - Exploit, Vendor Advisory~~	() https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56 - Exploit, Vendor Advisory

Information

Published : 2020-12-28 19:15

Updated : 2024-11-21 05:06

NVD link : CVE-2020-15898

Mitre link : CVE-2020-15898

CVE.ORG link : CVE-2020-15898

JSON object : View

Products Affected

arista

720xp-48zc2
7308x3
7050sx3-48yc12
7260cx
7050tx-72q
720xp-24zy4
7170-64c
7328x
7300x-64s
7050sx-128
eos
7050tx-48
7250qx-64
7050sx-64
7050tx2-128
7050sx3-96yc8
7050sx2-72q
7050cx3m-32s
7304x3
7300x-64t
7050sx2-128
7368x4
7170-32cd
7300x3-48yc4
7060sx2-48yc6
7324x
7300x-32q
7050qx-32s
7060cx-32s
7050sx3-48yc
7060px4-32
7050cx3-32s
7300x3-32c
7260qx
7050sx-72q
720xp-24y6
7050sx3-48yc8
7060cx2-32s
7320x-32c
7170-32c
7050sx3-48c8
7050tx-64
7260cx3
7260cx3-64
7050qx2-32s
720xp-48y6
720xp-96zc2
7050tx3-48c8
7060dx4-32

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-15898", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-12-28T19:15:12.783", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/11996-security-advisory-56", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train."}, {"lang": "es", "value": "En Arista EOS, los paquetes malformados pueden ser incorrectamente reenviados a trav\u00e9s de los l\u00edmites de la VLAN en una direcci\u00f3n. Esta vulnerabilidad solo es susceptible de explotaci\u00f3n por tr\u00e1fico unidireccional (por ejemplo, UDP) y no por tr\u00e1fico bidireccional (por ejemplo, TCP). Esto afecta a: plataformas EOS 7170 versi\u00f3n 4.21.4.1F y versiones por debajo en el tren 4.21.x; EOS X-Series versiones 4.21.11M y versiones por debajo en el tren 4.21.x; 4.22.6M y versiones por debajo en el tren 4.22.x; 4.23.4M y versiones por debajo en el tren 4.23.x; 4.24.2.1F y versiones por debajo en el tren 4.24.x"}], "lastModified": "2024-11-21T05:06:24.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D74FB457-3B38-49B2-80A7-A0541BAAFBD7", "versionEndIncluding": "4.21.4.1f", "versionStartIncluding": "4.21.0f"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arista:7170-32c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E8EFEEA5-0FC4-4FFC-BF5D-BDBAA1B55C70"}, {"criteria": "cpe:2.3:h:arista:7170-32cd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B2959C68-8731-4F37-B9E7-61E5936D3D8E"}, {"criteria": "cpe:2.3:h:arista:7170-64c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D6FB3395-8D13-4477-A46E-37A88272CFAB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F0F53EB-B0DE-42AB-A9F9-FFBAFC5F223A", "versionEndIncluding": "4.21.11m", "versionStartIncluding": "4.21.0f"}, {"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "188A9EBD-1DD4-4111-A66D-67C0A0035662", "versionEndIncluding": "4.22.6m", "versionStartIncluding": "4.22.0f"}, {"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F80FCF7B-38CD-43B5-82EE-139A0D249D70", "versionEndIncluding": "4.23.4m", "versionStartIncluding": "4.23.0f"}, {"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B02B2F63-75D5-4C8A-BAD3-CDFE1A31CE48", "versionEndIncluding": "4.24.2.1f", "versionStartIncluding": "4.24.0f"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arista:7050cx3-32s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E1FF0290-C671-4ABC-8A12-05E4D55FC4AE"}, {"criteria": "cpe:2.3:h:arista:7050cx3m-32s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "828C6E4F-814A-4060-8F5E-7FF359C8739C"}, {"criteria": "cpe:2.3:h:arista:7050qx-32s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "253D74DE-97F5-40F3-B179-D2D4442C57FD"}, {"criteria": "cpe:2.3:h:arista:7050qx2-32s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "75E03F9E-522F-4D9B-9267-09E2550B5465"}, {"criteria": "cpe:2.3:h:arista:7050sx-128:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "895A7AFD-BE76-47F5-B67B-6279046E4274"}, {"criteria": "cpe:2.3:h:arista:7050sx-64:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "74E258EC-EA50-4185-AA35-5D963C359E74"}, {"criteria": "cpe:2.3:h:arista:7050sx-72q:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1482D4FC-60B9-4C89-B892-71AA3E1031F3"}, {"criteria": "cpe:2.3:h:arista:7050sx2-128:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C99D84E9-2229-459E-AE90-49C2EF670884"}, {"criteria": "cpe:2.3:h:arista:7050sx2-72q:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D922C725-1139-4DD4-92FC-9FF15E35CE62"}, {"criteria": "cpe:2.3:h:arista:7050sx3-48c8:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FE35C17F-0C60-4A40-9949-D4C5D94D1D7A"}, {"criteria": "cpe:2.3:h:arista:7050sx3-48yc:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "07BA078E-30B7-4E2C-B240-BF64E98143E9"}, {"criteria": "cpe:2.3:h:arista:7050sx3-48yc12:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EBFD0706-CACB-40FA-A41B-46B39C6E1D33"}, {"criteria": "cpe:2.3:h:arista:7050sx3-48yc8:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5951D243-CB68-4B41-A913-D879CE502795"}, {"criteria": "cpe:2.3:h:arista:7050sx3-96yc8:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "73156612-D338-4E20-8C82-0E65DAA72331"}, {"criteria": "cpe:2.3:h:arista:7050tx-48:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "78E7CDCC-ADC6-4854-BFC4-72DA47C5F10B"}, {"criteria": "cpe:2.3:h:arista:7050tx-64:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2B03678D-AD7B-4B1A-8E6A-1811DD8B1483"}, {"criteria": "cpe:2.3:h:arista:7050tx-72q:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E803639C-13A1-48CA-A589-C83654AE454F"}, {"criteria": "cpe:2.3:h:arista:7050tx2-128:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A495D282-D3DC-4D18-AB72-2358834C238E"}, {"criteria": "cpe:2.3:h:arista:7050tx3-48c8:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "388C57D8-4B3C-4E5D-84AA-0CB7506F825A"}, {"criteria": "cpe:2.3:h:arista:7060cx-32s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D518C8D5-A86B-46E5-A646-8939BFA2E116"}, {"criteria": "cpe:2.3:h:arista:7060cx2-32s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A1608297-7079-4F3B-857E-708B74E944D9"}, {"criteria": "cpe:2.3:h:arista:7060dx4-32:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "806A01C5-231D-4F9D-A292-E9DD706A0C66"}, {"criteria": "cpe:2.3:h:arista:7060px4-32:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AC10746F-8FC0-49EF-BB9C-EC49B734DFA3"}, {"criteria": "cpe:2.3:h:arista:7060sx2-48yc6:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "26582E98-B710-46D7-B8F2-9286E0592FA6"}, {"criteria": "cpe:2.3:h:arista:720xp-24y6:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7AFDBCBB-2C1A-4B88-AE28-EF63D5B9EDD2"}, {"criteria": "cpe:2.3:h:arista:720xp-24zy4:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "58757129-BF9C-4BD8-B692-BB57023F8A48"}, {"criteria": "cpe:2.3:h:arista:720xp-48y6:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2756BB4B-1053-4EAC-AC0B-785FD5039D5F"}, {"criteria": "cpe:2.3:h:arista:720xp-48zc2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "40D36540-7723-4284-A207-6BD27728CA25"}, {"criteria": "cpe:2.3:h:arista:720xp-96zc2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DF95CB28-E010-4A1D-A746-F9DDF015868F"}, {"criteria": "cpe:2.3:h:arista:7250qx-64:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0DD95B3B-D655-42DC-85C2-2C6FDBCC77F1"}, {"criteria": "cpe:2.3:h:arista:7260cx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E40D14DE-BAFB-461F-9AA7-E3EDC2D8D468"}, {"criteria": "cpe:2.3:h:arista:7260cx3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "901E5B76-0EB7-4EAD-A281-15B9F78041AB"}, {"criteria": "cpe:2.3:h:arista:7260cx3-64:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "49BAE58E-F4B5-4C8F-9EEB-5A0F38A96F0C"}, {"criteria": "cpe:2.3:h:arista:7260qx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EE1DE992-9BFA-4794-82F4-66F464BB384E"}, {"criteria": "cpe:2.3:h:arista:7300x-32q:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DDF8A65D-6FBC-4C38-8B45-418E6C5EB16C"}, {"criteria": "cpe:2.3:h:arista:7300x-64s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8F088D51-24F4-49AD-8397-73D1EAF45F56"}, {"criteria": "cpe:2.3:h:arista:7300x-64t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "69BA5C6D-40C0-4AA3-AC10-D7F097D8EDD9"}, {"criteria": "cpe:2.3:h:arista:7300x3-32c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0040BDDF-D711-4619-9E96-96EFBD33CAA0"}, {"criteria": "cpe:2.3:h:arista:7300x3-48yc4:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D4AA716D-CAD1-4689-8A26-977A2E5F869E"}, {"criteria": "cpe:2.3:h:arista:7304x3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "78FE473B-CA6E-4E8D-8DBF-676B1ECBB185"}, {"criteria": "cpe:2.3:h:arista:7308x3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9F1EF943-154C-4B5B-B803-E186FEA8C5A0"}, {"criteria": "cpe:2.3:h:arista:7320x-32c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5AD08CBF-6F42-4F98-B413-F65C5613BE6B"}, {"criteria": "cpe:2.3:h:arista:7324x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B8862F74-E399-41EE-A081-62D99A7C1755"}, {"criteria": "cpe:2.3:h:arista:7328x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8F16261D-639F-4CAB-BDA6-EF3F277E663C"}, {"criteria": "cpe:2.3:h:arista:7368x4:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "161DB0D9-9BAC-4546-88D3-5547F4B6149C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}

5.3 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2020-15898

5.3^/10

5.0^/10

Attach tags to `CVE-2020-15898`