CVE-2023-24513

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-126 CWE-125

Affected software

Vendor	Product	Versions
Arista Networks	EOS	>= 4.29.0, <= 4.29.1F; >= 4.28.0, <= 4.28.5M; >= 4.27.0, <= 4.27.8M; >= 4.26.0, <= 4.26.9M

References

https://www.arista.com/en/support/advisories-notices/security-advisory/17240-security-advisory-0085Exploit, Patch, Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/17240-security-advisory-0085Exploit, Patch, Vendor Advisory

Timeline

Published: Apr 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-245146.1Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, CVE-2023-245156.5Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used whi CVE-2023-245165.4Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie CVE-2023-245177.2Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use CVE-2023-245187.1A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web CVE-2023-245198.8Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A speci CVE-2023-24524.4The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and includi CVE-2023-245208.8Two OS command injection vulnerability exist in the vtysh_ubus toolsh_excute.constprop.1 functionality of Milesight UR32L v32.3.0.5. A speci CVE-2023-245216.1Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 7 CVE-2023-245226.1Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthen CVE-2023-245238.8An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7 CVE-2023-245246.5SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in