CVE-2024-12831: (0Day) Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability
First published: Fri Dec 20 2024(Updated: )
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the uvm_login module. The issue results from incorrect authorization. An attacker can leverage this to escalate privileges to resources normally protected from the user. Was ZDI-CAN-24324.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arista Edge Threat Management - Arista NG Firewall | =17.1.1 | |
| Arista Edge Threat Management - Arista NG Firewall |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-12831?
CVE-2024-12831 is considered a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-12831?
To fix CVE-2024-12831, update the Arista NG Firewall to version 17.1.2 or later where the vulnerability is addressed.
Who is affected by CVE-2024-12831?
CVE-2024-12831 affects users of the Arista NG Firewall running version 17.1.1.
What type of vulnerability is CVE-2024-12831?
CVE-2024-12831 is an incorrect authorization privilege escalation vulnerability.
Can CVE-2024-12831 be exploited remotely?
No, CVE-2024-12831 requires local access to the system to exploit the vulnerability.
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/title
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-1720
- alias/ZDI-CAN-24324
- alias/CVE-2024-12831
- vendor/arista
- canonical/arista edge threat management - arista ng firewall
- version/arista edge threat management - arista ng firewall/17.1.1