CVE-2018-11548: An issue was discovered in EOS.IO DAWN 4.2

This month

HIGH 7.5REMOTEDOWNGRADE

CVE-2018-11548 is a high-severity flaw (CVSS 7.5) affecting eos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same source IP address.

Why this priority

High severity
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.3% (top 29%)
CISA exploited list	No
Weakness	CWE-20
Published	2018-05-29
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: block

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2018-05-29 21:29 UTCPublished CVE record published
2026-06-17 01:36 UTCUpdated Record last modified

block eos DOWNGRADE

Affected: dawn-4.2.0

Fixed in: no fixed release known

Safe to downgrade to: a release before dawn-4.2.0

1. Check installed version

apt-cache policy eos || rpm -q eos || eos --version

2. No fixed release: DOWNGRADE to a release before dawn-4.2.0 (Debian / Ubuntu)

apt-cache madison eos sudo apt install eos=<VERSION_BEFORE_dawn-4.2.0> sudo apt-mark hold eos

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list eos sudo dnf downgrade eos-<VERSION_BEFORE_dawn-4.2.0> sudo dnf versionlock add eos

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2018-11548?

eos: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2018-11548 being exploited?

CVE-2018-11548 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2018-11548 affect?

CVE-2018-11548 affects eos. Severity is high (CVSS 7.5). An issue was discovered in EOS.IO DAWN 4.2. plugins/net_plugin/net_plugin.cpp does not limit the number of P2P connections from the same source IP address.

How urgent is CVE-2018-11548?

Priority 49/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-7473 MEDIUM 5.8 EXPLOITED MITIGATE Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
CVE-2024-6387 HIGH 8.1 MITIGATE MITIGATE A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
CVE-2023-24512 HIGH 8.8 UPGRADE MITIGATE On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests cou
CVE-2023-24511 MEDIUM 5.3 UPGRADE On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory l
CVE-2023-24510 HIGH 7.5 UPGRADE On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

References

← Back to latest CVEs