psirt@arista.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS psirt@arista.com
03
assessed vulnerabilities (159)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-114625US | —OT critical | KEV | ||
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successf… | ||||
| CVE-2026-102169US | — | — | ||
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with… | ||||
| CVE-2026-102168US | — | — | ||
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with… | ||||
| CVE-2026-102167US | — | — | ||
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor… | ||||
| CVE-2026-102165US | — | — | ||
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentiall… | ||||
| CVE-2026-102164US | — | — | ||
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelle… | ||||
| CVE-2026-102163US | — | — | ||
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame… | ||||
| CVE-2026-102162US | — | — | ||
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an una… | ||||
| CVE-2026-102161US | —OT elevated | — | ||
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their sourc… | ||||
| CVE-2026-102160US | — | — | ||
An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute a… | ||||
| CVE-2026-102159US | —OT elevated | — | ||
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may… | ||||
| CVE-2026-102158US | — | — | ||
Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against… | ||||
| CVE-2026-102157US | — | — | ||
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to a… | ||||
| CVE-2026-102156US | — | — | ||
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inj… | ||||
| CVE-2026-102155US | — | — | ||
An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary loca… | ||||
| CVE-2026-101158US | — | — | ||
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Suc… | ||||
| CVE-2026-101157US | — | — | ||
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated… | ||||
| CVE-2026-101156US | — | — | ||
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in… | ||||
| CVE-2026-101155US | — | — | ||
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or cr… | ||||
| CVE-2026-101154US | — | — | ||
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or cr… | ||||