On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
References
| Link | Resource |
|---|---|
| https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
25 Apr 2023, 14:19
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Arista 7808r3
Arista 7812r3 Arista 704x3 Arista 7304x3 Arista 7324x Arista 7308x Arista 758x Arista 7328x Arista 7512r Arista 7504r Arista 755x Arista 7516r Arista 7504r3 Arista Arista 7512r3 Arista 7508r3 Arista 7304x Arista 7316x Arista 7804r3 Arista 7816r3 Arista eos Arista 7508r |
|
| CPE | cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7328x:-:*:*:*:*:*:*:* cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7516r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7504r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:758x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7512r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7324x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:755x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7508r:-:*:*:*:*:*:*:* cpe:2.3:h:arista:704x3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7304x3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7316x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7308x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7304x:-:*:*:*:*:*:*:* cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082 - Exploit, Mitigation, Vendor Advisory |
13 Apr 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-13 20:15
Updated : 2023-04-25 14:19
NVD link : CVE-2023-24509
Mitre link : CVE-2023-24509
JSON object : View
Products Affected
arista
- 7508r
- 7508r3
- 7808r3
- 704x3
- eos
- 755x
- 7812r3
- 7304x3
- 7308x
- 7304x
- 758x
- 7512r3
- 7328x
- 7504r
- 7512r
- 7804r3
- 7504r3
- 7816r3
- 7324x
- 7316x
- 7516r
CWE