High severity · published May 8, 2025
CVE-2024-8100
On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
8.7
CVSS
0.6%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
CloudVision · Arista Networks
2024.3.0; 2024.0 through 2024.2; 2023.3.0 through 2023.3.1; 2023.0 through 2023.2; 2022; 2021; +3 more · source: vendor