Vulnerability · Published Jun 13, 2023 · Assigned by Arista

CVE-2023-24546

High 8.1

In plain English

A high-severity improper access control in CloudVision. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.

Affected products (as reported)

Vendor	Product	Versions
n/a	CloudVision	<2021.1.0, <2021.2.0, <2021.3.0,

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://www.arista.com/en/support/advisories-notices/security-advisory/17022-security-advisory-0083