Lucene search
AristaCVE-2023-24512HistoryApr 25, 2023 - 9:15 p.m.
CVE-2023-24512
2023-04-2521:15:10
CWE-284
CWE-863
Arista
web.nvd.nist.gov
27
cve-2023-24512
arista eos
authorized attacker
gnmi requests
switch configurations
nvd
security vulnerability
information security
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
6.4
Confidence
High
EPSS
0.001
Percentile
23.5%
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision
Affected configurations
Node
arista32qdMatch-
ORarista48ehsMatch-
ORarista48lbasMatch-
ORarista48lbsMatch-
ORarista48s6qdMatch-
ORarista7010t-48Match-
ORarista7020sr-24c2Match-
ORarista7020sr-32c2Match-
ORarista7020tr-48Match-
ORarista7020tra-48Match-
ORarista7050cx3-32sMatch-
ORarista7050cx3m-32sMatch-
ORarista7050qx-32sMatch-
ORarista7050qx2-32sMatch-
ORarista7050sx-128Match-
ORarista7050sx-64Match-
ORarista7050sx-72qMatch-
ORarista7050sx2-128Match-
ORarista7050sx2-72qMatch-
ORarista7050sx3-48c8Match-
ORarista7050sx3-48ycMatch-
ORarista7050sx3-48yc12Match-
ORarista7050sx3-48yc8Match-
ORarista7050sx3-96yc8Match-
ORarista7050tx-48Match-
ORarista7050tx-64Match-
ORarista7050tx-72qMatch-
ORarista7050tx2-128Match-
ORarista7050tx3-48c8Match-
ORarista7060cx-32sMatch-
ORarista7060cx2-32sMatch-
ORarista7060dx4-32Match-
ORarista7060px4-32Match-
ORarista7060sx2-48yc6Match-
ORarista7130-16g3sMatch-
ORarista7130-48g3sMatch-
ORarista7130-96sMatch-
ORarista7150s-24Match-
ORarista7150s-52Match-
ORarista7150s-64Match-
ORarista7150sc-24Match-
ORarista7150sc-64Match-
ORarista7160-32cqMatch-
ORarista7160-48tc6Match-
ORarista7160-48yc6Match-
ORarista7170-32cMatch-
ORarista7170-32cdMatch-
ORarista7170-64cMatch-
ORarista7170b-64cMatch-
ORarista720df-48yMatch-
ORarista720dp-24sMatch-
ORarista720dp-48sMatch-
ORarista720dt-24sMatch-
ORarista720dt-48sMatch-
ORarista720xp-24y6Match-
ORarista720xp-24zy4Match-
ORarista720xp-48y6Match-
ORarista720xp-48zc2Match-
ORarista720xp-96zc2Match-
ORarista7250qx-64Match-
ORarista7260cxMatch-
ORarista7260cx3Match-
ORarista7260qxMatch-
ORarista7260sx2Match-
ORarista7280cr2k-60Match-
ORarista7280cr3-32d4Match-
ORarista7280cr3-32p4Match-
ORarista7280cr3-96Match-
ORarista7280cr3k-32d4Match-
ORarista7280cr3k-32p4Match-
ORarista7280cr3k-96Match-
ORarista7280dr3-24Match-
ORarista7280dr3k-24Match-
ORarista7280eMatch-
ORarista7280pr3-24Match-
ORarista7280pr3k-24Match-
ORarista7280sr3-48yc8Match-
ORarista7280sr3k-48yc8Match-
ORarista7300x-32qMatch-
ORarista7300x-64sMatch-
ORarista7300x-64tMatch-
ORarista7300x3-32cMatch-
ORarista7300x3-48yc4Match-
ORarista7320x-32cMatch-
ORarista7358x4Match-
ORarista7368x4Match-
ORarista7388x5Match-
ORarista7500r3-24dMatch-
ORarista7500r3-24pMatch-
ORarista7500r3-36cqMatch-
ORarista7500r3k-36cqMatch-
ORarista7804r3Match-
ORarista7808r3Match-
ORarista7812r3Match-
ORarista7816r3Match-
ORarista96lbsMatch-
ORaristadcs-7010tx-48Match-
ORaristadcs-7500-12cq-lcMatch-
ORaristadcs-7500e-12cm-lcMatch-
ORaristadcs-7500e-36q-lcMatch-
ORaristadcs-7500e-48s-lcMatch-
ORaristadcs-7500e-6c2-lcMatch-
ORaristadcs-7500e-72s-lcMatch-
ORaristadcs-7500r-36cq-lcMatch-
ORaristadcs-7500r-36q-lcMatch-
ORaristadcs-7500r-48s2cq-lcMatch-
aristaeosRange4.26.0–4.26.10m
ORaristaeosRange4.27.0–4.27.9m
ORaristaeosRange4.28.0–4.28.6m
ORaristaeosRange4.29.0–4.29.2f
Node
aristaceos-lab
ORaristacloudeosMatch-
ORaristaveos-labMatch-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| arista | 32qd | - | cpe:2.3:h:arista:32qd:-:*:*:*:*:*:*:* |
| arista | 48ehs | - | cpe:2.3:h:arista:48ehs:-:*:*:*:*:*:*:* |
| arista | 48lbas | - | cpe:2.3:h:arista:48lbas:-:*:*:*:*:*:*:* |
| arista | 48lbs | - | cpe:2.3:h:arista:48lbs:-:*:*:*:*:*:*:* |
| arista | 48s6qd | - | cpe:2.3:h:arista:48s6qd:-:*:*:*:*:*:*:* |
| arista | 7010t-48 | - | cpe:2.3:h:arista:7010t-48:-:*:*:*:*:*:*:* |
| arista | 7020sr-24c2 | - | cpe:2.3:h:arista:7020sr-24c2:-:*:*:*:*:*:*:* |
| arista | 7020sr-32c2 | - | cpe:2.3:h:arista:7020sr-32c2:-:*:*:*:*:*:*:* |
| arista | 7020tr-48 | - | cpe:2.3:h:arista:7020tr-48:-:*:*:*:*:*:*:* |
| arista | 7020tra-48 | - | cpe:2.3:h:arista:7020tra-48:-:*:*:*:*:*:*:* |
CNA Affected
[
{
"vendor": "Arista Networks",
"product": "Terminattr",
"versions": [
{
"version": "1.23.0",
"status": "affected"
},
{
"version": "unspecified",
"lessThanOrEqual": "1.19.5",
"status": "affected",
"versionType": "custom"
},
{
"version": "1.24.0",
"status": "affected",
"lessThanOrEqual": "1.24.3",
"versionType": "custom"
},
{
"version": "1.22.0",
"status": "affected",
"lessThanOrEqual": "1.22.1",
"versionType": "custom"
}
]
}
]Related
cvelist
cvelist
arista
arista
Security Advisory 0086
2023-04-25 00:00:00
nvd
nvd
CVE-2023-24512
2023-04-25 21:15:10
prion
prion
Design/Logic Flaw
2023-04-25 21:15:00
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
6.4
Confidence
High
EPSS
0.001
Percentile
23.5%
Related for CVE-2023-24512