Vulnerability · Published May 8, 2025 · Assigned by Arista
CVE-2025-0505On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state
Critical 10.0
In plain English
A critical-severity privilege mismanagement in CloudVision Portal from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.7%top 48.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | CloudVision Portal | 2024.2.0 – through 2024.2.12024.3.0 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N