CVE-2023-24511 — MEDIUM (5.3)

Q: How severe is CVE-2023-24511?

CVE-2023-24511 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2023-24511?

Check the references section above for vendor advisories and patch information. Affected products include: Arista Eos, Arista Ceos-Lab, Arista Cloudeos, Arista Veos-Lab, Arista 7010T.

Vulnerability Description

On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Arista	Eos	>= 4.26.0, < 4.26.10m
Arista	Ceos-Lab	-
Arista	Cloudeos	-
Arista	Veos-Lab	-
Arista	7010T	-
Arista	7010T-48	-
Arista	7010Tx-48	-
Arista	7010Tx-48-Dc	-
Arista	7020Sr-24C2	-
Arista	7020Sr-32C2	-
Arista	7020Tr-48	-
Arista	7020Tra-48	-
Arista	7050Cx3-32S	-
Arista	7050Cx3M-32S	-
Arista	7050Qx-32S	-
Arista	7050Qx2-32S	-
Arista	7050Sx-128	-
Arista	7050Sx-64	-
Arista	7050Sx-72Q	-
Arista	7050Sx2-128	-

Related Weaknesses (CWE)

CWE-401

References

https://www.arista.com/en/support/advisories-notices/security-advisory/17239-secExploitPatchVendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/17239-secExploitPatchVendor Advisory

FAQ

What is CVE-2023-24511?

CVE-2023-24511 is a vulnerability with a CVSS score of 5.3 (MEDIUM). On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causin...

How severe is CVE-2023-24511?

CVE-2023-24511 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-24511?

Check the references section above for vendor advisories and patch information. Affected products include: Arista Eos, Arista Ceos-Lab, Arista Cloudeos, Arista Veos-Lab, Arista 7010T.