Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-24509

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.

Published

2023-04-13T20:15:08.843

Last Modified

2024-11-21T07:48:00.993

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.3 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-269
  • Type: Primary
    NVD-CWE-noinfo
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System arista eos ≤ 4.23.13m Yes
Operating System arista eos < 4.24.11m Yes
Operating System arista eos < 4.25.10m Yes
Operating System arista eos < 4.26.9m Yes
Operating System arista eos < 4.27.7m Yes
Operating System arista eos < 4.28.4m Yes
Hardware arista 704x3 - No
Hardware arista 7304x - No
Hardware arista 7304x3 - No
Hardware arista 7308x - No
Hardware arista 7316x - No
Hardware arista 7324x - No
Hardware arista 7328x - No
Hardware arista 7504r - No
Hardware arista 7504r3 - No
Hardware arista 7508r - No
Hardware arista 7508r3 - No
Hardware arista 7512r - No
Hardware arista 7512r3 - No
Hardware arista 7516r - No
Hardware arista 755x - No
Hardware arista 758x - No
Hardware arista 7804r3 - No
Hardware arista 7808r3 - No
Hardware arista 7812r3 - No
Hardware arista 7816r3 - No
References