What is CVE-2023-24509?

CVE-2023-24509 is a critical-severity vulnerability in Arista 704x3, classified under Improper Privilege Management. CVSS score: 9.3/10. Published 2023-04-13.

How severe is CVE-2023-24509?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Privilege escalation in Arista 704x3

CVE-2023-24509

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root use…

Vulnerability class: Privilege Escalation

EPSS: 0.002 (14.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Arista 704x3
Arista 7304x
Arista 7304x3
Arista 7308x
Arista 7316x
Arista 7324x
Arista 7328x
Arista 7504r
Arista 7504r3
Arista 7508r

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

psirt@arista.com (Exploit, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2023-24509?: CVE-2023-24509 is a critical-severity vulnerability in Arista 704x3, classified under Improper Privilege Management. CVSS score: 9.3/10. Published 2023-04-13.
How severe is CVE-2023-24509?: Critical severity. CVSS v3 base score is 9.3 out of 10.