{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9448", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2024-10-02T20:39:01.319Z", "datePublished": "2025-05-08T19:14:00.226Z", "dateUpdated": "2025-05-08T19:29:47.601Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "EOS", "vendor": "Arista Networks", "versions": [{"status": "affected", "version": "4.33.0"}, {"lessThanOrEqual": "4.32.3M", "status": "affected", "version": "4.32.0", "versionType": "custom"}, {"lessThanOrEqual": "4.31.5M", "status": "affected", "version": "4.31.0", "versionType": "custom"}, {"lessThanOrEqual": "4.30.8M", "status": "affected", "version": "4.30.0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In order to be vulnerable to CVE-2024-9448, the following condition must be met:</p><div>A Traffic Policy must be configured:</div><div>&nbsp;</div><pre>switch&gt;show traffic-policy vlan\nTraffic policy myPolicy\n&nbsp; &nbsp;Configured on VLANs: 42, 43\n&nbsp; &nbsp;Applied on VLANs for IPv4 traffic: 42, 43\n&nbsp; &nbsp;Applied on VLANs for IPv6 traffic: 42, 43\n&nbsp; &nbsp;Total number of rules configured: 4\n&nbsp; &nbsp; &nbsp; match anIpv4Rule ipv4\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span style=\"background-color: rgb(255, 255, 0);\">Actions: Drop</span>\n&nbsp; &nbsp; &nbsp; match anIpv6Rule ipv6\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span style=\"background-color: rgb(255, 255, 0);\">Actions: Drop</span>\n&nbsp; &nbsp; &nbsp; match ipv4-all-default ipv4\n&nbsp; &nbsp; &nbsp; match ipv6-all-default ipv6\nswitch&gt;\n</pre><div>&nbsp;</div><div>If a Traffic Policy is not configured there is no exposure to this issue and the message will look something like:</div><div>&nbsp;</div><pre>switch&gt;show traffic-policy vlan \nswitch&gt;</pre><br>"}], "value": "In order to be vulnerable to CVE-2024-9448, the following condition must be met:\n\nA Traffic Policy must be configured:\n\n\u00a0\n\nswitch>show traffic-policy vlan\nTraffic policy myPolicy\n\u00a0 \u00a0Configured on VLANs: 42, 43\n\u00a0 \u00a0Applied on VLANs for IPv4 traffic: 42, 43\n\u00a0 \u00a0Applied on VLANs for IPv6 traffic: 42, 43\n\u00a0 \u00a0Total number of rules configured: 4\n\u00a0 \u00a0 \u00a0 match anIpv4Rule ipv4\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0Actions: Drop\n\u00a0 \u00a0 \u00a0 match anIpv6Rule ipv6\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0Actions: Drop\n\u00a0 \u00a0 \u00a0 match ipv4-all-default ipv4\n\u00a0 \u00a0 \u00a0 match ipv6-all-default ipv6\nswitch>\n\n\n\u00a0\n\nIf a Traffic Policy is not configured there is no exposure to this issue and the message will look something like:\n\n\u00a0\n\nswitch>show traffic-policy vlan \nswitch>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.</span><br>"}], "value": "On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations."}], "impacts": [{"capecId": "CAPEC-200", "descriptions": [{"lang": "en", "value": "CAPEC-200 Removal of filters: Input filters, output filters, data masking"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-05-08T19:14:00.226Z"}, "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21121-security-advisory-0112"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><div>CVE-2024-9448 has been fixed in the following releases:</div><ul><li>4.33.1F and later releases in the 4.33.x train</li><li>4.32.4M and later releases in the 4.32.x train</li><li>4.31.6M and later releases in the 4.31.x train</li><li>4.30.9M and later releases in the 4.30.x train</li></ul><br>"}], "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2024-9448 has been fixed in the following releases:\n\n * 4.33.1F and later releases in the 4.33.x train\n * 4.32.4M and later releases in the 4.32.x train\n * 4.31.6M and later releases in the 4.31.x train\n * 4.30.9M and later releases in the 4.30.x train"}], "source": {"advisory": "112", "defect": ["BUG 992963"], "discovery": "INTERNAL"}, "title": "On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropp", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">There is no mitigation other than to not use the Traffic Policy feature where it would be expected to match on receipt of untagged packets.</span><br>"}], "value": "There is no mitigation other than to not use the Traffic Policy feature where it would be expected to match on receipt of untagged packets."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-08T19:28:16.811276Z", "id": "CVE-2024-9448", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T19:29:47.601Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9448", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-08T19:28:16.811276Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T19:29:42.365Z"}}], "cna": {"title": "On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropp", "source": {"defect": ["BUG 992963"], "advisory": "112", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-200", "descriptions": [{"lang": "en", "value": "CAPEC-200 Removal of filters: Input filters, output filters, data masking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.33.0"}, {"status": "affected", "version": "4.32.0", "versionType": "custom", "lessThanOrEqual": "4.32.3M"}, {"status": "affected", "version": "4.31.0", "versionType": "custom", "lessThanOrEqual": "4.31.5M"}, {"status": "affected", "version": "4.30.0", "versionType": "custom", "lessThanOrEqual": "4.30.8M"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2024-9448 has been fixed in the following releases:\n\n * 4.33.1F and later releases in the 4.33.x train\n * 4.32.4M and later releases in the 4.32.x train\n * 4.31.6M and later releases in the 4.31.x train\n * 4.30.9M and later releases in the 4.30.x train", "supportingMedia": [{"type": "text/html", "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><div>CVE-2024-9448 has been fixed in the following releases:</div><ul><li>4.33.1F and later releases in the 4.33.x train</li><li>4.32.4M and later releases in the 4.32.x train</li><li>4.31.6M and later releases in the 4.31.x train</li><li>4.30.9M and later releases in the 4.30.x train</li></ul><br>", "base64": false}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21121-security-advisory-0112"}], "workarounds": [{"lang": "en", "value": "There is no mitigation other than to not use the Traffic Policy feature where it would be expected to match on receipt of untagged packets.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">There is no mitigation other than to not use the Traffic Policy feature where it would be expected to match on receipt of untagged packets.</span><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2024-9448, the following condition must be met:\n\nA Traffic Policy must be configured:\n\n\u00a0\n\nswitch>show traffic-policy vlan\nTraffic policy myPolicy\n\u00a0 \u00a0Configured on VLANs: 42, 43\n\u00a0 \u00a0Applied on VLANs for IPv4 traffic: 42, 43\n\u00a0 \u00a0Applied on VLANs for IPv6 traffic: 42, 43\n\u00a0 \u00a0Total number of rules configured: 4\n\u00a0 \u00a0 \u00a0 match anIpv4Rule ipv4\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0Actions: Drop\n\u00a0 \u00a0 \u00a0 match anIpv6Rule ipv6\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0Actions: Drop\n\u00a0 \u00a0 \u00a0 match ipv4-all-default ipv4\n\u00a0 \u00a0 \u00a0 match ipv6-all-default ipv6\nswitch>\n\n\n\u00a0\n\nIf a Traffic Policy is not configured there is no exposure to this issue and the message will look something like:\n\n\u00a0\n\nswitch>show traffic-policy vlan \nswitch>", "supportingMedia": [{"type": "text/html", "value": "<p>In order to be vulnerable to CVE-2024-9448, the following condition must be met:</p><div>A Traffic Policy must be configured:</div><div>&nbsp;</div><pre>switch&gt;show traffic-policy vlan\nTraffic policy myPolicy\n&nbsp; &nbsp;Configured on VLANs: 42, 43\n&nbsp; &nbsp;Applied on VLANs for IPv4 traffic: 42, 43\n&nbsp; &nbsp;Applied on VLANs for IPv6 traffic: 42, 43\n&nbsp; &nbsp;Total number of rules configured: 4\n&nbsp; &nbsp; &nbsp; match anIpv4Rule ipv4\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span style=\"background-color: rgb(255, 255, 0);\">Actions: Drop</span>\n&nbsp; &nbsp; &nbsp; match anIpv6Rule ipv6\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span style=\"background-color: rgb(255, 255, 0);\">Actions: Drop</span>\n&nbsp; &nbsp; &nbsp; match ipv4-all-default ipv4\n&nbsp; &nbsp; &nbsp; match ipv6-all-default ipv6\nswitch&gt;\n</pre><div>&nbsp;</div><div>If a Traffic Policy is not configured there is no exposure to this issue and the message will look something like:</div><div>&nbsp;</div><pre>switch&gt;show traffic-policy vlan \nswitch&gt;</pre><br>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-05-08T19:14:00.226Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9448", "state": "PUBLISHED", "dateUpdated": "2025-05-08T19:29:47.601Z", "dateReserved": "2024-10-02T20:39:01.319Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2025-05-08T19:14:00.226Z", "assignerShortName": "Arista"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations."}, {"lang": "es", "value": "En las plataformas afectadas que ejecutan Arista EOS con las pol\u00edticas de tr\u00e1fico configuradas, la vulnerabilidad provocar\u00e1 que los paquetes recibidos sin etiquetar no cumplan las reglas de pol\u00edtica de tr\u00e1fico que deber\u00edan. Si la regla descartara el paquete, este no se descartar\u00e1, sino que se reenviar\u00e1 como si la regla no existiera. Esto podr\u00eda provocar que los paquetes se entreguen a destinos inesperados."}], "id": "CVE-2024-9448", "lastModified": "2025-05-12T17:32:52.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "psirt@arista.com", "type": "Secondary"}]}, "published": "2025-05-08T20:15:28.753", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21121-security-advisory-0112"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}