PT-2024-31764 · Arista · Arista Wireless Access Points

David Miller · Published 2024-06-27 · Updated 2024-06-27 · CVE-2024-4578

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Arista Wireless Access Points (affected versions not specified)

Description: The issue allows an entity with the ability to authenticate via SSH to an affected Arista Wireless Access Point as the config user to cause a privilege escalation via spawning a bash shell. The SSH CLI session does not require high permissions to exploit this issue, but the config password is required to establish the session. The spawned shell is able to obtain root privileges.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-4578

Affected Products

Arista Wireless Access Points

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2024-4578 · Security Note
• https://arista.com/en/support/advisories-notices/security-advisory/19844-security-advisory-0098 · Note