Medium severity · published Dec 6, 2023
CVE-2023-24547
On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote…
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by authenticated users, as well as appear in clear text in the device’s running config.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mos · Arista
0.13.0 through 0.39.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24547
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24547
Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/18644-security-advisory-0090
More from Mos
7.5
CVE-2019-17596
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key