« Back to list

CVE-2023-24546

Status: ModifiedHigh (8.1)—

On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Arista — Cloudvision Portal

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2023-24546",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-24546",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-06T15:35:46.216946Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@arista.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "CloudVision",
          "versions": [
            {
              "status": "affected",
              "version": "<2021.1.0, <2021.2.0, <2021.3.0,"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-06-13T21:15:09.867",
  "references": [
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/17022-security-advisory-0083",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@arista.com"
    },
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/17022-security-advisory-0083",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@arista.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service."
    }
  ],
  "lastModified": "2026-06-17T05:39:30.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arista:cloudvision_portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8E8D1BB-B7ED-4886-96A0-FD0C9EA666CC",
              "versionEndIncluding": "2021.3",
              "versionStartIncluding": "2021.1"
            },
            {
              "criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F429F0B9-A090-434C-8576-182CC021B76A"
            },
            {
              "criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB325C9E-8116-434D-9865-DE494EC05F27"
            },
            {
              "criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF2BF57D-7677-4531-80F8-15842798FBA2"
            },
            {
              "criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08760308-AB42-496A-B473-98DAF7E4EDE1"
            },
            {
              "criteria": "cpe:2.3:a:arista:cloudvision_portal:2022.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF6936F8-946B-4A33-B1AD-76F0EFB65223"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@arista.com"
}