CVE-2024-12378

On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

State: Published
Severity: 9.1 Critical
Published: May 8, 2025
Updated: May 8, 2025
Reserved: Dec 9, 2024

Read the record on cve.org

Description

On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	Arista

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
CloudVision PortalArista Networks	4.32.0 through 4.32.2FAffected 4.31.0 through 4.31.6MAffected 4.30.0 through 4.30.8MAffected 4.29.0 through 4.29.9MAffected 4.28.0 through 4.28.12MAffected 4.27.0 through 4.27.12MAffected

References

https://www.arista.com/en/support/advisories-notices/security-advisory/21289-security-advisory-0113

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.