CVE-2024-9448

Estado: AplazadaAlta (7.5)—

On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.59%
Percentil entre todas las CVEs puntuadas: 47
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access75 %
Impacto principalT1565.002 Transmitted Data Manipulationimpact65 %
Impacto secundarioT1498.001 Direct Network Floodimpact55 %

AV:N sin autenticación sugiere T1190. El bypass de políticas de tráfico permite manipulación de rutas (T1565.002) y potencial DoS si reglas de drop se eluden (T1498.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Encrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Arista — EOS^AI

CWE

CWE-1284

Referencias

https://https://www.arista.com/en/support/advisories-notices/security-advisory/21121-security-advisory-0112

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-9448",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9448",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-08T19:28:16.811276Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@arista.com",
      "affectedData": [
        {
          "vendor": "Arista Networks",
          "product": "EOS",
          "versions": [
            {
              "status": "affected",
              "version": "4.33.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.33.0F"
            },
            {
              "status": "affected",
              "version": "4.32.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.32.3M"
            },
            {
              "status": "affected",
              "version": "4.31.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.31.5M"
            },
            {
              "status": "affected",
              "version": "4.30.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.30.8M"
            }
          ],
          "platforms": [
            "EOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-08T20:15:28.753",
  "references": [
    {
      "url": "https://https://www.arista.com/en/support/advisories-notices/security-advisory/21121-security-advisory-0112",
      "source": "psirt@arista.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@arista.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations."
    },
    {
      "lang": "es",
      "value": "En las plataformas afectadas que ejecutan Arista EOS con las políticas de tráfico configuradas, la vulnerabilidad provocará que los paquetes recibidos sin etiquetar no cumplan las reglas de política de tráfico que deberían. Si la regla descartara el paquete, este no se descartará, sino que se reenviará como si la regla no existiera. Esto podría provocar que los paquetes se entreguen a destinos inesperados."
    }
  ],
  "lastModified": "2026-06-17T08:24:35.350",
  "sourceIdentifier": "psirt@arista.com"
}