Vulnerability · Published Apr 13, 2023 · Assigned by Arista
CVE-2023-24509On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...
Critical 9.3
In plain English
A critical-severity privilege mismanagement in Arista EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | Arista EOS | 4.23.0 4.23.13M4.28.0 – through 4.28.3M4.27.0 – through 4.27.6M4.286.0 – through 4.26.8M4.25.0 – through 4.25.9M4.24.0 – through 4.24.10M |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H