Vulnerability · Published May 8, 2025 · Assigned by Arista
CVE-2024-8100On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
High 8.7
In plain English
A high-severity privilege mismanagement in CloudVision from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.6%top 49.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | CloudVision | 2024.3.02024.0 – through 2024.22023.3.0 – through 2023.3.12023.0 – through 2023.22022202120202019 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N