PatchTheCVECVE-2023-24511: On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory l
CVE-2023-24511 is a medium-severity flaw (CVSS 5.3) affecting eos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 42%) |
| CISA exploited list | No |
| Weakness | CWE-401 |
| Published | 2023-04-12 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-24511?
eos: upgrade to 4.26.10m, 4.27.9m, 4.28.6m, 4.29.2f. Exact commands for each OS are on this page.
Is CVE-2023-24511 being exploited?
CVE-2023-24511 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-24511 affect?
CVE-2023-24511 affects eos. Severity is medium (CVSS 5.3). On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd
How urgent is CVE-2023-24511?
Priority 43/100. Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-7473 MEDIUM 5.8 EXPLOITED MITIGATE Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
- CVE-2024-6387 HIGH 8.1 MITIGATE MITIGATE A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
- CVE-2023-24512 HIGH 8.8 UPGRADE MITIGATE On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests cou
- CVE-2023-24510 HIGH 7.5 UPGRADE On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.
- CVE-2023-24509 CRITICAL 9.3 UPGRADE On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having th