High severity · published Dec 20, 2024
CVE-2024-12829
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability.
The specific flaw exists within the ExecManagerImpl class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24015.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
NG Firewall · Arista
17.1.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12829
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12829
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-1717/
More from NG Firewall
9.8
CVE-2024-9132
The administrator is able to configure an insecure captive portal script
9.6
CVE-2025-2767
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability
8.8
CVE-2024-9188
Specially constructed queries cause cross platform scripting leaking administrator tokens
8.8
CVE-2024-27889
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW)
8.3
CVE-2024-9134
Multiple SQL Injection vulnerabilities exist in the reporting application