fkie_nvd - fkie_cve-2023-24509

FKIE_CVE-2023-24509

Vulnerability from fkie_nvd - Published: 2023-04-13 20:15 - Updated: 2024-11-21 07:48

Severity ?

9.3 (Critical) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.

References

	URL	Tags
	psirt@arista.com	https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082	Exploit, Mitigation, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082	Exploit, Mitigation, Vendor Advisory

Impacted products

Vendor	Product	Version
arista	eos	*
arista	eos	*
arista	eos	*
arista	eos	*
arista	eos	*
arista	eos	*
arista	704x3	-
arista	7304x	-
arista	7304x3	-
arista	7308x	-
arista	7316x	-
arista	7324x	-
arista	7328x	-
arista	7504r	-
arista	7504r3	-
arista	7508r	-
arista	7508r3	-
arista	7512r	-
arista	7512r3	-
arista	7516r	-
arista	755x	-
arista	758x	-
arista	7804r3	-
arista	7808r3	-
arista	7812r3	-
arista	7816r3	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "498704F8-24D4-48C9-A5CB-4A8F7054AA49",
              "versionEndIncluding": "4.23.13m",
              "versionStartIncluding": "4.23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8923F137-B1BA-49FF-A100-AD357966EE4F",
              "versionEndExcluding": "4.24.11m",
              "versionStartIncluding": "4.24.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D6EA8CE-BAA4-4B4D-8A9F-A65018FC6B3A",
              "versionEndExcluding": "4.25.10m",
              "versionStartIncluding": "4.25.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "659190E5-DFB0-4172-BD6F-1B9E22533CE5",
              "versionEndExcluding": "4.26.9m",
              "versionStartIncluding": "4.26.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "20966F67-1C70-458C-A4EF-02612345DE48",
              "versionEndExcluding": "4.27.7m",
              "versionStartIncluding": "4.27.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F57FAA3-518C-498C-9580-19A207C8F176",
              "versionEndExcluding": "4.28.4m",
              "versionStartIncluding": "4.28.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:arista:704x3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7C0C33F-72A7-41CA-A666-1CEC9F0FE02F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7304x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "65C6E0C9-7F81-4CE3-BD46-7939667E5969",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7304x3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "78FE473B-CA6E-4E8D-8DBF-676B1ECBB185",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7308x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7A8ABF1-ADF4-474D-B01B-8BB271E1263E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7316x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "73ECE6D6-12E5-4396-9C19-3B2E08E13147",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7324x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8862F74-E399-41EE-A081-62D99A7C1755",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7328x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F16261D-639F-4CAB-BDA6-EF3F277E663C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7504r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD1F369D-93BF-4259-99F5-97FBEF79BBA5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8387CCEA-F00C-4F1F-B966-ACF8B16F1D22",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7508r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F35978B6-889C-47DB-971B-B2A12FF537E0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "55AE2A1C-A4FD-423B-A77E-2E24C2310A6A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7512r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2360E039-5F12-4210-8578-7EBDA4575A6E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4B0D708-B426-4CA1-BE87-08BD14B7EACE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7516r:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D45E5E5-7EB9-41E7-8EEE-570E6646EDDD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:755x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "585E3617-2B1F-4E58-853A-0E9703B91B80",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:758x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "13B1D90C-73CC-49A2-B202-B07D96226729",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A54F3D32-5A07-4791-90BF-96BD8A24C2F6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F078B04-2DA0-4A4B-BB1A-408DC14CB61F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E9B99200-EC76-404E-9900-5D1DC3B9A758",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A172A49-1A0E-464B-BDDD-A8F52856D595",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability."
    }
  ],
  "id": "CVE-2023-24509",
  "lastModified": "2024-11-21T07:48:00.993",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 6.0,
        "source": "psirt@arista.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-04-13T20:15:08.843",
  "references": [
    {
      "source": "psirt@arista.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082"
    }
  ],
  "sourceIdentifier": "psirt@arista.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "psirt@arista.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2023-24509 (GCVE-0-2023-24509)

Vulnerability from cvelistv5 – Published: 2023-04-13 00:00 – Updated: 2025-02-07 15:42

Summary

Severity ?

9.3 (Critical)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Assigner

Arista

References

URL

Tags

https://www.arista.com/en/support/advisories-noti…

Impacted products

	Vendor	Product	Version
	Arista Networks	Arista EOS	Affected: 4.23.0 4.23.13M Affected: 4.28.0 , ≤ 4.28.3M (custom) Affected: 4.27.0 , ≤ 4.27.6M (custom) Affected: 4.286.0 , ≤ 4.26.8M (custom) Affected: 4.25.0 , ≤ 4.25.9M (custom) Affected: 4.24.0 , ≤ 4.24.10M (custom)

Credits

Arista would like to acknowledge and thank Marc-André Labonté, Senior Information Security Analyst at Desjardins for responsibly reporting CVE-2023-24509.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:56:04.282Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-24509",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T15:42:03.820627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-07T15:42:09.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Arista EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "status": "affected",
              "version": "4.23.0 4.23.13M"
            },
            {
              "lessThanOrEqual": "4.28.3M",
              "status": "affected",
              "version": "4.28.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.27.6M",
              "status": "affected",
              "version": "4.27.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.26.8M",
              "status": "affected",
              "version": "4.286.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.25.9M",
              "status": "affected",
              "version": "4.25.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.24.10M",
              "status": "affected",
              "version": "4.24.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "In order to be vulnerable to CVE-2023-24509, the following conditions must be met:\n\nTwo supervisor modules must both be inserted and active. To determine the status of the supervisor modules,\n\nswitch#show module \nModule  Ports Card Type                Model            Serial No.\n------- ----- ------------------------ ---------------- -----------\n1       3     DCS-7500-SUP2 Supervisor DCS-7500-SUP2    SSJ17133450\n2       2     Standby supervisor       DCS-7500-SUP2    SSJ17133441\n \nModule  Status  Uptime  Power off reason\n------- ------- ------- ----------------\n1       Active  0:24:58 N/A\n2       Standby 0:24:58 N/A\nSupervisor redundancy protocol must be configured with RPR(Route Processor Redundancy) or SSO (Stateful Switchover) on the switch. To determine the state and the current redundancy protocol of both supervisors on the switch,\n\nswitch#show redundancy status\n  my state = ACTIVE\npeer state = STANDBY WARM\n      Unit = Primary\n   Unit ID = 1\n   \nRedundancy Protocol (Operational) = Route Processor Redundancy\nRedundancy Protocol (Configured) = Route Processor Redundancy\nCommunications = Up\nReady for switchover\n   \n  Last switchover time = 7:23:56 ago\nLast switchover reason = Supervisor has control of the active supervisor lock"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Arista would like to acknowledge and thank Marc-Andr\u00e9 Labont\u00e9, Senior Information Security Analyst at Desjardins for responsibly reporting CVE-2023-24509."
        }
      ],
      "datePublic": "2023-02-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-13T00:00:00.000Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/16985-security-advisory-0082"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2023-24509 has been fixed in the following releases:\n\n4.28.4M and later releases in the 4.28.x train\n4.27.7M and later releases in the 4.27.x train\n4.26.9M and later releases in the 4.26.x train\n4.25.10M and later releases in the 4.25.x train\n4.24.11M and later releases in the 4.24.x train"
        },
        {
          "lang": "en",
          "value": "The following hotfix can be applied to remediate CVE-2023-24509. The hotfix only applies to the releases listed below and no other releases. All other versions require upgrading to a release containing the fix (as listed above).: \n\n4.28.3M and below releases in the 4.28.x train\n4.27.6M and below releases in the 4.27.x train\n4.26.8M and below releases in the 4.26.x train\n4.25.9M and below releases in the 4.25.x train\n4.24.10M\n4.23.13M\nNote: Installing/uninstalling the SWIX will cause ConfigAgent to restart and disconnect existing CLI sessions.\n\nVersion: 1.0\n\nURL: SecurityAdvisory82_CVE-2023-24509_Hotfix.swix\n\nSWIX hash:\n\n(SHA-512)7833ab99e11cfea1ec28c09aedffd062cfc865a20a843ee6184caff1081e748c8a02590644d0c7b0e377027379cbaadc8b1a70d1c37097bf98c1bedb429dca56"
        }
      ],
      "source": {
        "advisory": "82",
        "defect": [
          "723401"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...",
      "workarounds": [
        {
          "lang": "en",
          "value": "The workaround is to disable \u201cssh\u201d CLI command in unprivileged mode on the SSH client devices by using command authorization. This can be done with Role-Based Access Control (RBAC).\n\nIf the \u201cssh\u201d CLI command is currently used to connect to a remote host, the destination address can be added to an allowlist with RBAC."
        }
      ],
      "x_ConverterErrors": {
        "TITLE": {
          "error": "TITLE too long. Truncating in v5 record.",
          "message": "Truncated!"
        }
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2023-24509",
    "datePublished": "2023-04-13T00:00:00.000Z",
    "dateReserved": "2023-01-24T00:00:00.000Z",
    "dateUpdated": "2025-02-07T15:42:09.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2023-24509

CVE-2023-24509 (GCVE-0-2023-24509)

Tags

Sightings

Nomenclature