Security Advisories
a8娱乐 is committed to maintaining the highest standards of security across our product portfolio. Leveraging extensive testing and monitoring of vulnerabilities to isolate and neutralize threats early, a8娱乐's Product Security Incident Response Team (PSIRT) provides global coverage for public reporting of possible security vulnerabilities across the product portfolio.
The PSIRT team monitors industry-wide vulnerability reporting as well as providing a single point of contact for customers and interested third parties to investigate and identify potential threats. The PSIRT team also works to communicate these issues back to the user community in a timely manner.
a8娱乐's approach to vulnerability management and links to best practice guidelines can be found here.
For technical assistance with workarounds and hotfix installations recommended in security advisories, please contact the a8娱乐 Support team at 该邮件地址已受到反垃圾邮件插件保护。要显示它需要在浏览器中启用 JavaScript。.
Report security vulnerabilities found in a8娱乐 products to the PSIRT team via 该邮件地址已受到反垃圾邮件插件保护。要显示它需要在浏览器中启用 JavaScript。. It is recommended to use a8娱乐's PGP key for secure and private communication directly with the PSIRT team.
a8娱乐 PSIRT is happy to work with researchers on discovered vulnerabilities in a8娱乐 products, the assignment of CVEs, and timelines for responsible disclosure. If a researcher discovers a new vulnerability they will be acknowledged in the advisory related to the vulnerability. a8娱乐 PSIRT is interested in receiving reports on issues affecting features in both a8娱乐 code as well as Open Source Software used in a8娱乐 products. Security issues found in Open Source Software which do not affect a8娱乐 products are out of the scope of a8娱乐 and should be referred to the appropriate CNA found .
PSIRT Advisories
The following advisories and referenced materials are provided on an "as is" basis for use at your own risk. a8娱乐 reserves the right to change or update the advisories without notice at any time.
Security Advisory 0116
April 15, 2025
On affected versions of the a8娱乐 CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
This vulnerability was discovered internally and a8娱乐 is not aware of any malicious uses of this issue in customer networks.
Security Advisory 0115
April 15, 2025
On a8娱乐 CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.
The issue was discovered internally by a8娱乐. a8娱乐 is not aware of any malicious uses of this issue in customer networks.
Security Advisory 0114
April 15, 2025
On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the a8娱乐 CloudVision Portal products when run on-premise. It does not impact CloudVision as-a-Service.
The issue was discovered internally by a8娱乐. a8娱乐 is not aware of any malicious uses of this issue in customer networks.
Security Advisory 0113
April 8, 2025
?
On affected platforms running a8娱乐 EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
a8娱乐 is not aware of any malicious uses of this issue in customer networks.
Security Advisory 0112
On affected platforms running a8娱乐 EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.
This vulnerability is being tracked by BUG 992963
Security Advisory 0111
For both CVE-2025-1259 and CVE-2025-1260, on affected platforms running a8娱乐 EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.
CVE-2025-1259 can result in users retrieving data that should not have been available.
CVE-2025-1260 can result in unexpected configuration/operations being applied to the switch.
These issues were discovered internally, and a8娱乐 is unaware of any malicious uses of these issues in customer networks. These are similar types of authorization issues and are being released together due to their similarity.
The CVE-IDs tracking this issue: CVE-2025-1259 and CVE-2025-1260
Security Advisory 0110
On affected platforms running a8娱乐 EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping.
The CVE-ID tracking this issue: CVE-2024-9135
Security Advisory 0109
On affected platforms running a8娱乐 EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart.
The CVE-ID tracking this issue: CVE-2024-8000
Security Advisory 0108
On affected platforms running a8娱乐 EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.
The CVE-ID tracking this issue: CVE-2024-6437
Security Advisory 0107
On affected platforms running a8娱乐 EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated (causing SNMP requests to time out until snmpd is restarted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well. This was discovered internally by a8娱乐 and we are not aware of any malicious uses of this issue in customer networks.
The CVE-ID tracking this issue: CVE-2024-7095