High severity · published Dec 20, 2024
CVE-2024-12831
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the uvm_login module. The issue results from incorrect authorization. An attacker can leverage this to escalate privileges to resources normally protected from the user. Was ZDI-CAN-24324.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
NG Firewall · Arista
17.1.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12831
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12831
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-1720/
More from NG Firewall
9.8
CVE-2024-9132
The administrator is able to configure an insecure captive portal script
9.6
CVE-2025-2767
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability
8.8
CVE-2024-9188
Specially constructed queries cause cross platform scripting leaking administrator tokens
8.8
CVE-2024-12829
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability
8.8
CVE-2024-27889
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW)