On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
References
| Link | Resource |
|---|---|
| https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 | Exploit Mitigation Vendor Advisory |
| https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:48
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.3 |
| References | () https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 - Exploit, Mitigation, Vendor Advisory |
25 Apr 2023, 14:19
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7308x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:* cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7304x3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7304x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:755x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7512r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7516r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7508r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7328x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7504r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7316x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7324x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:758x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:704x3:-:*:*:*:*:*:*:* |
|
| First Time |
Arista
Arista 7512r3 Arista 704x3 Arista 7808r3 Arista 7328x Arista 7308x Arista 7504r Arista 7512r Arista 758x Arista 7504r3 Arista 755x Arista 7812r3 Arista 7804r3 Arista 7316x Arista 7508r3 Arista 7516r Arista 7508r Arista 7304x Arista 7304x3 Arista 7816r3 Arista eos Arista 7324x |
|
| References | (MISC) https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 - Exploit, Mitigation, Vendor Advisory | |
| CWE | NVD-CWE-noinfo |
13 Apr 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-13 20:15
Updated : 2024-11-21 07:48
NVD link : CVE-2023-24509
Mitre link : CVE-2023-24509
CVE.ORG link : CVE-2023-24509
JSON object : View
Products Affected
arista
- 7816r3
- 7324x
- 7812r3
- 7328x
- eos
- 7516r
- 758x
- 704x3
- 7504r
- 7804r3
- 7512r3
- 7512r
- 7808r3
- 7304x3
- 7304x
- 7504r3
- 7316x
- 7508r
- 7308x
- 755x
- 7508r3
CWE