CVE-2024-11186: On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-prem

Published May 8, 2025

Updated

On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise. It does not impact CloudVision as-a-Service.

Affected Software

1 affected component

Arista CloudVision Portal

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see CloudVision Users Guide https://www.arista.io/help/2024.3/articles/dXBncmFkZS5BbGwudXBncmFkZQ== . CVE-2024-11186 has been fixed in the following releases: * 2025.1.0 and later releases in the 2025.1.x train * 2024.3.1 and later releases in the 2024.3.x train * 2024.2.2 and later releases in the 2024.2.x train * 2024.1.3 and later releases in the 2024.1.x train

Event History

May 8, 2025

CVE Published

via MITRE·06:47 PM

Data Sourced

via MITRE·06:47 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-11186?

CVE-2024-11186 has been rated as a critical severity vulnerability due to improper access controls allowing escalation of privileges.

How do I fix CVE-2024-11186?

To fix CVE-2024-11186, ensure that you apply the latest security patch provided by Arista for the CloudVision Portal.

What systems are affected by CVE-2024-11186?

CVE-2024-11186 affects on-premise installations of the Arista CloudVision Portal.

Who can exploit CVE-2024-11186?

CVE-2024-11186 can be exploited by a malicious authenticated user to gain unauthorized access to managed EOS devices.

What are the risks associated with CVE-2024-11186?

The risks associated with CVE-2024-11186 include unauthorized actions on managed EOS devices, potentially leading to network compromise.