CVE-2024-12378: On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

Published May 8, 2025

Updated

On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

Affected Software

1 affected component

Arista EOS

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-12378 has been fixed in the following releases: * 4.33.0F and later releases in the 4.33.x train * 4.32.3M and later releases in the 4.32.x train * 4.31.7M and later releases in the 4.31.x train * 4.30.9M and later releases in the 4.30.x train * 4.29.10M and later releases in the 4.29.x train

Event History

May 8, 2025

CVE Published

via MITRE·07:05 PM

Data Sourced

via MITRE·07:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-12378?

CVE-2024-12378 is considered a high severity vulnerability due to the exposure of sensitive data over secure Vxlan tunnels.

How do I fix CVE-2024-12378?

To mitigate CVE-2024-12378, ensure that the Tunnelsec agent is not restarted unnecessarily on Arista EOS systems.

What are the consequences of CVE-2024-12378?

The consequence of CVE-2024-12378 is that sensitive packets may be sent unencrypted over a secure Vxlan tunnel, risking data exposure.

Which systems are affected by CVE-2024-12378?

CVE-2024-12378 affects platforms running Arista EOS with secure Vxlan configurations.

What is the impact of CVE-2024-12378 on network security?

The impact of CVE-2024-12378 on network security is significant as it can lead to unauthorized data interception and compromise of secure communications.