High severity · published Jun 13, 2023
CVE-2023-24546
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to…
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cloudvision Portal · Arista
2021.1 through 2021.3; 2022.1.0; 2022.1.1; 2022.2.0; 2022.2.1; 2022.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24546
Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/17022-security-advisory-0083
More from Cloudvision Portal
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
8.8
CVE-2016-9012
CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane, related to a request…
7.8
CVE-2019-18181
In CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for restricted functionality via CVP API calls…
7.5
CVE-2020-13881
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used
7.5
CVE-2019-17596
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key