Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-102162] On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at le…

On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-102163] On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthe…

On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-102165] On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the captu…

On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-102167] On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's w…

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-73456] Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampli…

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

16/09/2026

Vulnerabilidad crítica en Arista EOS con P4Runtime permite ejecución remota de código

Una vulnerabilidad de puntuación CVSS 10 en Arista EOS permite que clientes no autenticados ejecuten código arbitrario con privilegios administrativos en switches configurados con P4Runtime. Aunque P4Runtime está deshabilitado por defecto, equipos que lo han activado para programabilidad de red enfrentan riesgo crítico. Esta falla afecta especialmente a proveedores de servicios y operadores de centros de datos en Latinoamérica que utilizan infraestructura Arista.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad alta en Arista EOS OSPFv3: reinicio no autorizado de agente

Una vulnerabilidad en Arista EOS con OSPFv3 configurado (CVSS 7.5) permite que paquetes especialmente crafteados causen el reinicio inesperado del agente OSPFv3, interrumpiendo la disponibilidad de enrutadores en infraestructuras altas. El impacto afecta principalmente a operadores de redes en centros de datos y proveedores de conectividad en LATAM que dependen de equipos Arista para su backbone de red.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad alta en Arista EOS con OSPFv2 permite denegación de servicio en redes

Arista EOS es vulnerable a packets OSPFv2 especialmente diseñados que pueden ser enviados por atacantes no autenticados en el mismo segmento de broadcast. La vulnerabilidad provoca inestabilidad en adyacencias OSPF y pérdida de paquetes, disrumpiendo el enrutamiento en dominios OSPF amplios. En infraestructuras altas de LATAM (telecomunicaciones, finanzas, energía) esto compromete la disponibilidad de servicios de red.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad alta en Arista EOS con gNSI permite escalada de privilegios (CVE-2026-73454)

Plataformas Arista EOS con interfaz gRPC Network Security Interface (gNSI) Credentialz configurada son vulnerables a solicitudes especialmente diseñadas que modifican propiedades de cuentas de usuario. Un atacante podría asignar privilegios elevados a cuentas existentes, comprometiendo el control de acceso en infraestructura de red alta. El impacto afecta directamente a proveedores de servicios y centros de datos en LATAM que dependen de equipos Arista para segmentación y control de tráfico.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad alta en Arista EOS permite ejecución remota de código con privilegios root

Arista EOS presenta una vulnerabilidad (CVSS 8.8) en la interfaz gRPC Network Management Interface (gNMI) que permite a clientes autenticados ejecutar código arbitrario con privilegios root en switches de red. Afecta infraestructuras altas de centros de datos y proveedores de servicios en LATAM que utilizan equipos Arista con gNMI habilitado. El riesgo es elevado en entornos de nube privada y redes corporativas donde estos switches gestionan tráfico sensible.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-2380] Vulnerabilidad de registro no autorizado en Arista EOS con servicios OpenConfig

Plataformas Arista EOS ejecutando servicios OpenConfig (gNMI, gNSI, RESTCONF, NETCONF) registran inadecuadamente solicitudes y respuestas sensibles en el dispositivo local o servidores de contabilidad remota, exponiendo credenciales y configuraciones altas. La vulnerabilidad afecta infraestructuras de redes datacenter y carriers en LATAM que utilizan automatización basada en OpenConfig para gestión de equipos Arista.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad alta en Arista EOS: fallo en validación de políticas gNSI Pathz (CVE-2026-73439)

Plataformas Arista EOS con OpenConfig y servidor gNMI configurados pueden fallar en la validación de políticas gNSI Pathz cuando existen reglas simultáneas de grupo y usuario para la misma ruta, permitiendo que usuarios autenticados eludan restricciones de acceso. Esta vulnerabilidad afecta directamente a infraestructuras de red en centros de datos y proveedores de servicios en LATAM que dependen de estos controles de seguridad para gestionar acceso remoto.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-73447] A privileged attacker can exploit certain operation to execute arbitrary commands with root privileg…

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-73446] On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthen…

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-73459] On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can …

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-73437] On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay confi…

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious n…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-73458] On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD)…

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66653] Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

Unauthenticated Local File Inclusion in Barista

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-17191] An input validation vulnerability exists in an API component of the orchestrator. An authenticated u…

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not awa…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17192] A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on …

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer net…

nvdaltovulnerabilidad CVSS 8.5 NVD