title: On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...
description: On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
problem types: CWE-269 Improper Privilege Management
affected:
{
vendor: Arista Networks
product: Arista EOS
versions:
version: 4.23.0 4.23.13M, status: affected
version: 4.28.0, status: affected, lessThanOrEqual: 4.28.3M, versionType: custom
version: 4.27.0, status: affected, lessThanOrEqual: 4.27.6M, versionType: custom
version: 4.286.0, status: affected, lessThanOrEqual: 4.26.8M, versionType: custom
version: 4.25.0, status: affected, lessThanOrEqual: 4.25.9M, versionType: custom
version: 4.24.0, status: affected, lessThanOrEqual: 4.24.10M, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
]
solutions: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2023-24509 has been fixed in the following releases:
4.28.4M and later releases in the 4.28.x train
4.27.7M and later releases in the 4.27.x train
4.26.9M and later releases in the 4.26.x train
4.25.10M and later releases in the 4.25.x train
4.24.11M and later releases in the 4.24.x train
workarounds: The workaround is to disable “ssh” CLI command in unprivileged mode on the SSH client devices by using command authorization. This can be done with Role-Based Access Control (RBAC).
If the “ssh” CLI command is currently used to connect to a remote host, the destination address can be added to an allowlist with RBAC.