CoreCVE
Back

HIGH

On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropp

Published May 8, 2025

Description

On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.

Affected products

Remediation

Vendor solution

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades

CVE-2024-9448 has been fixed in the following releases:

* 4.33.1F and later releases in the 4.33.x train * 4.32.4M and later releases in the 4.32.x train * 4.31.6M and later releases in the 4.31.x train * 4.30.9M and later releases in the 4.30.x train

Weaknesses (1)

CWE-1284

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Arista
Published May 8, 2025
Updated Aug 25, 2025
Reserved Oct 2, 2024
Link CVE-2024-9448
CISA Vulnrichment
Updated May 8, 2025
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2024-9448
Red Hat
Severity n/a
Public date n/a
Links CVE-2024-9448