CVE-2020-11622
CVE-2020-11622 is a high-severity vulnerability in Arista Cloudeos with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v2: 4.3
- EPSS exploit prediction: 1% (66th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Arista Cloudeos
- Published:
- Last modified:
Description
A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368.*, 4.21.4-FCRFX.*, 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1 Router code in a scenario where TCP MSS options are configured.
Frequently asked questions
- What is CVE-2020-11622?
- A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368.*, 4.21.4-FCRFX.*, 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1 Router code in a scenario where TCP MSS options are configured.
- How severe is CVE-2020-11622?
- CVE-2020-11622 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2020-11622 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-11622?
- CVE-2020-11622 primarily affects Arista Cloudeos. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-11622?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2020-11622 published?
- CVE-2020-11622 was published on 2020-06-10 and last updated on 2026-06-17.
References
- https://www.arista.com/en/support/advisories-notices
- https://www.arista.com/en/support/advisories-notices/security-advisories/11195-security-advisory-49
Affected products (18)
- cpe:2.3:a:arista:cloudeos:*:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.21.3fx-7368:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.21.4-fcrfx:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.21.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.21.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.22.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.22.2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.22.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:cloudeos:4.23.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:*:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.21.3fx-7368:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.21.4-fcrfx:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.21.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.21.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.22.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.22.2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.22.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:arista:veos:4.23.2.1:*:*:*:*:*:*:*
More vulnerabilities in Arista Cloudeos
- CVE-2023-24512 — High (CVSS 8.8): On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft…
- CVE-2023-24545 — High (CVSS 7.5): On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential…
- CVE-2023-24513 — Medium (CVSS 6.5): On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential…