PT-2020-13333 · Arista · Arista Cloudvision Exchange (Cvx) Server

Published 2020-10-26 · Updated 2020-11-02 · CVE-2020-13100

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Arista CloudVision eXchange (CVX) server versions prior to 4.21.12M Arista CloudVision eXchange (CVX) server versions 4.22.x prior to 4.22.7M Arista CloudVision eXchange (CVX) server versions 4.23.x prior to 4.23.5M Arista CloudVision eXchange (CVX) server versions 4.24.x prior to 4.24.2F

Description The issue allows remote attackers to cause a denial of service, resulting in the crash and restart of the ControllerOob agent, via a malformed control-plane packet.

Recommendations For versions prior to 4.21.12M, update to version 4.21.12M or later. For versions 4.22.x prior to 4.22.7M, update to version 4.22.7M or later. For versions 4.23.x prior to 4.23.5M, update to version 4.23.5M or later. For versions 4.24.x prior to 4.24.2F, update to version 4.24.2F or later.

Exploit

Fix

Related Identifiers

CVE-2020-13100

Affected Products

Arista Cloudvision Exchange (Cvx) Server

References · 3

• 🔥 https://arista.com/en/support/advisories-notices/security-advisories/11758-security-advisory-52 · Exploit
• https://osv.dev/vulnerability/CVE-2020-13100 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13100 · Security Note