Back to overview

CVE-2025-0505

CRITICAL
10.0
CVSS 3.1
Description
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.

Metadata

CVE ID
CVE-2025-0505
State
PUBLISHED
Assigner
Arista
Reserved
2025-01-15 19:34 UTC
Published
2025-05-08 18:37 UTC
Last updated
2025-05-08 18:56 UTC
Primary CWE
CWE-269
CWE-269 Improper Privilege Management
Vendor / Product
Arista Networks / CloudVision Portal
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Arista Networks CloudVision Portal — 2024.2.0 ≤ 2024.2.1, 2024.3.0
Weakness (CWE)
CWESourceDescription
CWE-269 cna CWE-269 Improper Privilege Management
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
References (1)
Back to overview