CVE-2020-15898 Security feature bypass in n/a
Attackers can bypass VLAN isolation to read traffic across boundaries using unidirectional packets on Arista EOS switches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15898?
CVE-2020-15898 is a medium-severity vulnerability in n/a, published on 28 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability is only susceptible to exploitation by unidirectional traffic (ex. UDP) and not bidirectional traffic (ex. TCP). This affects: EOS 7170 platforms version 4.21.4.1F and below releases in the 4.21.x train; EOS X-Series versions 4.21.11M and below releases in the 4.21.x train; 4.22.6M and below releases in the 4.22.x train; 4.23.4M and below releases in the 4.23.x train; 4.24.2.1F and below releases in the 4.24.x train.
Which versions are affected by CVE-2020-15898?
It affects 1 product.
Products include Arista Eos.
How do I fix CVE-2020-15898?
No fix has been published for CVE-2020-15898 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-15898 being exploited?
There is no known exploitation of CVE-2020-15898 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-63qj-x5v8-6jj4.