SB2025052768 - Incorrect ACL enforcement in Arista EOS
Published: May 27, 2025
Security Bulletin ID
SB2025052768
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper access control (CVE-ID: CVE-2025-2826)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to improper enforcement of ACL policies. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to incorrectly be allowed or denied.
Remediation
Install update from vendor's website.