On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
References
Link | Resource |
---|---|
https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
25 Apr 2023, 14:19
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 - Exploit, Mitigation, Vendor Advisory | |
First Time |
Arista 7324x
Arista 7304x Arista 7804r3 Arista 7504r3 Arista 7508r Arista 7316x Arista 7516r Arista Arista eos Arista 7512r Arista 7308x Arista 7816r3 Arista 758x Arista 755x Arista 704x3 Arista 7504r Arista 7808r3 Arista 7328x Arista 7512r3 Arista 7812r3 Arista 7304x3 Arista 7508r3 |
|
CPE | cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7316x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7308x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7504r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7508r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7324x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7512r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:* cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* cpe:2.3:h:arista:758x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7328x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7304x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7516r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7304x3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:755x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:704x3:-:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
CWE | NVD-CWE-noinfo |
13 Apr 2023, 20:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-04-13 20:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-24509
Mitre link : CVE-2023-24509
CVE.ORG link : CVE-2023-24509
JSON object : View
Products Affected
arista
- 7504r
- 7304x3
- 7316x
- 7308x
- 7812r3
- 7516r
- 7324x
- 7816r3
- 755x
- 758x
- 704x3
- 7328x
- 7508r
- 7804r3
- eos
- 7508r3
- 7512r3
- 7512r
- 7808r3
- 7504r3
- 7304x
CWE