CVE-2024-11186: On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-prem
First published: Thu May 08 2025(Updated: )
On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise. It does not impact CloudVision as-a-Service.
Credit: psirt@arista.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arista CloudVision |
Remedy
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see CloudVision Users Guide https://www.arista.io/help/2024.3/articles/dXBncmFkZS5BbGwudXBncmFkZQ== . CVE-2024-11186 has been fixed in the following releases: * 2025.1.0 and later releases in the 2025.1.x train * 2024.3.1 and later releases in the 2024.3.x train * 2024.2.2 and later releases in the 2024.2.x train * 2024.1.3 and later releases in the 2024.1.x train
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-11186?
CVE-2024-11186 has been rated as a critical severity vulnerability due to improper access controls allowing escalation of privileges.
How do I fix CVE-2024-11186?
To fix CVE-2024-11186, ensure that you apply the latest security patch provided by Arista for the CloudVision Portal.
What systems are affected by CVE-2024-11186?
CVE-2024-11186 affects on-premise installations of the Arista CloudVision Portal.
Who can exploit CVE-2024-11186?
CVE-2024-11186 can be exploited by a malicious authenticated user to gain unauthorized access to managed EOS devices.
What are the risks associated with CVE-2024-11186?
The risks associated with CVE-2024-11186 include unauthorized actions on managed EOS devices, potentially leading to network compromise.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/weakness
- agent/remedy
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/arista
- canonical/arista cloudvision