CVE Feed

    Dashboard / CVE / CVE-2023-3646

    CVE-2023-3646

    On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.

    Published:Aug 29, 2023
    Last Modified:Nov 21, 2024
    EPS:Aug 29, 2023
    EPSS Score:0.00147
    CVSS Score:5.9

    Affected Products

    Vendor
    Arista
    Product
    7280cr3-32d4
    Vendor
    Arista
    Product
    7280cr3-32p4
    Vendor
    Arista
    Product
    7280cr3-36s
    Vendor
    Arista
    Product
    7280cr3-96
    Vendor
    Arista
    Product
    7280cr3a-24d12
    Vendor
    Arista
    Product
    7280cr3a-48d6
    Vendor
    Arista
    Product
    7280cr3a-72
    Vendor
    Arista
    Product
    7280dr3-24
    Vendor
    Arista
    Product
    7280dr3a-36
    Vendor
    Arista
    Product
    7280dr3a-54
    Vendor
    Arista
    Product
    7280dr3ak-36
    Vendor
    Arista
    Product
    7280dr3ak-54
    Vendor
    Arista
    Product
    7280dr3am-36
    Vendor
    Arista
    Product
    7280dr3am-54
    Vendor
    Arista
    Product
    7280pr3-24
    Vendor
    Arista
    Product
    7280r3
    Vendor
    Arista
    Product
    7280sr3-40yc6
    Vendor
    Arista
    Product
    7280sr3-48yc8
    Vendor
    Arista
    Product
    7280tr3-40c6
    Vendor
    Arista
    Product
    7289r3a-sc
    Vendor
    Arista
    Product
    7289r3ak-sc
    Vendor
    Arista
    Product
    7289r3am-sc
    Vendor
    Arista
    Product
    7500r3-24d
    Vendor
    Arista
    Product
    7500r3-24p
    Vendor
    Arista
    Product
    7500r3-36cq
    Vendor
    Arista
    Product
    7500r3k-36cq
    Vendor
    Arista
    Product
    7500r3k-48y4d
    Vendor
    Arista
    Product
    7504r3
    Vendor
    Arista
    Product
    7508r3
    Vendor
    Arista
    Product
    7512r3
    Vendor
    Arista
    Product
    7800r3-36d
    Vendor
    Arista
    Product
    7800r3-36p
    Vendor
    Arista
    Product
    7800r3-48cq
    Vendor
    Arista
    Product
    7800r3a-36d
    Vendor
    Arista
    Product
    7800r3a-36dm
    Vendor
    Arista
    Product
    7800r3a-36p
    Vendor
    Arista
    Product
    7800r3a-36pm
    Vendor
    Arista
    Product
    7800r3ak-36dm
    Vendor
    Arista
    Product
    7800r3ak-36pm
    Vendor
    Arista
    Product
    7800r3k-36dm
    Vendor
    Arista
    Product
    7800r3k-48cq
    Vendor
    Arista
    Product
    7800r3k-48cqms
    Vendor
    Arista
    Product
    7800r3k-72y7512r3
    Vendor
    Arista
    Product
    7808r3
    Vendor
    Arista
    Product
    7812r3
    Vendor
    Arista
    Product
    7816r3
    Vendor
    Arista
    Product
    Eos

    Exploits

    https://www.arista.com/en/support/advisories-notices/security-advisory/18042-security-advisory-0088https://www.arista.com/en/support/advisories-notices/security-advisory/18042-security-advisory-0088

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-7473 (CVSS 6.9) — On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Ext…
    CVE-2023-24548 (CVSS 5.3) — On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a…
    CVE-2023-24512 (CVSS 8.8) — On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests cou…
    CVE-2023-24511 (CVSS 5.3) — On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory l…
    CVE-2021-28509 (CVSS 6.1) — This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetr…
    CVE-2021-28508 (CVSS 6.8) — This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetr…
    CVE-2020-24360 (CVSS 7.4) — An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may resu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High