High severity · published Apr 13, 2023
CVE-2023-24509
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
Eos · Arista
4.23 through 4.23.13m; 4.24.0 before 4.24.11m; 4.25.0 before 4.25.10m; 4.26.0 before 4.26.9m; 4.27.0 before 4.27.7m; 4.28.0 before 4.28.4m · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24509
Exploit
https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082
More from Eos
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
5.8
CVE-2026-7473
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
9.8
CVE-2021-28503
The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to…
9.8
CVE-2020-10188
utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the…