title: On Arista MOS configuration of a BGP password will cause the password to be logged in clear text.
description: On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by authenticated users, as well as appear in clear text in the device’s running config.
problem types: cwe-212
affected:
{
defaultStatus: unaffected
product: MOS
vendor: Arista Networks
versions:
lessThanOrEqual: 0.39.4, status: affected, version: 0.13.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see the  MOS User Guide: Updating https://mako.arista.com/dyn/softwareportal/artefact/3688/mos-0.39.1-userguide.pdf
CVE-2023-24547 has been fixed in the following releases:
*  MOS-0.36.10 and later releases in the MOS-0.36.x train
*  MOS-0.39.4 and later releases in the MOS-0.39.x train
Because this issue would cause the password to be saved in logs and remote AAA servers it is recommended to also rotate the BGP password, if possible. Upon upgrading to a new release, the BGP password will be obfuscated with the type-7 algorithm as shown below:
switch>show running-config bgp
router bgp 65000
neighbor 192.0.2.1 remote-as 66000
neighbor 192.0.2.1 password key 7 00143242404C5B140B
workarounds: No mitigation exists.