Multiple vulnerabilities in Arista Edge Threat Management



Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2024-9131
CVE-2024-9132
CVE-2024-9133
CVE-2024-9134
CVE-2024-47517
CVE-2024-47518
CVE-2024-47519
CVE-2024-47520
CVE-2024-9188
CWE-ID CWE-88
CWE-94
CWE-200
CWE-89
CWE-552
CWE-319
CWE-284
CWE-352
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Arista Edge Threat Management - Arista NG Firewall (NGFW)
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor Arista Networks

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Improper Neutralization of Argument Delimiters in a Command

EUVDB-ID: #VU109371

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-9131

CWE-ID: CWE-88 - Argument Injection or Modification

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation when handling CLI arguments. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU109372

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-9132

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote privileged user to escalate privileges on the system.

The vulnerability exists due to improper input validation. A remote privileged user can configure execution of captive portal script and escalate privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU109373

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-9133

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to an unspecified error. A remote user with administrator privileges can retrieve authentication tokens.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) SQL injection

EUVDB-ID: #VU109374

Risk: Medium

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-9134

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user with advanced report application access can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU109375

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47517

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Files or Directories Accessible to External Parties

EUVDB-ID: #VU109376

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47518

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to missing access restrictions. A remote user can send a specially crafted request to ETM and discover active remote access sessions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Cleartext transmission of sensitive information

EUVDB-ID: #VU109377

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-47519

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can intercept Backup uploads to ETM.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper access control

EUVDB-ID: #VU109378

Risk: Medium

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-47520

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user with advanced report application access rights  can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Cross-site request forgery

EUVDB-ID: #VU109379

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-9188

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website and obtain administrator tokens.

Successful exploitation of the vulnerability may lead to a system compromise.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): before 17.2

CPE2.3 External links

https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###