CVE-2024-8100: On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
First published: Thu May 08 2025(Updated: )
On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
Credit: psirt@arista.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arista CloudVision |
Remedy
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see CVP Software downloads https://www.arista.com/en/support/software-download CVE-2024-8100 has been fixed in the following releases: * 2024.1.3 and later releases in the 2024.1.x train * 2024.2.2 and later releases in the 2024.2.x train * 2024.3.1 and later releases in the 2024.3.x train * 2025.1.0 and later releases in the 2025.1.x train
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-8100?
CVE-2024-8100 has a high severity rating due to its potential to allow unauthorized admin access to the Arista CloudVision Portal.
How do I fix CVE-2024-8100?
To mitigate CVE-2024-8100, update to the latest version of the Arista CloudVision Portal that addresses this vulnerability.
What are the impacts of CVE-2024-8100?
CVE-2024-8100 can allow an attacker to use a compromised onboarding token to gain full administrative privileges on the Arista CloudVision Portal.
Which versions of Arista CloudVision are affected by CVE-2024-8100?
CVE-2024-8100 affects specific versions of the Arista CloudVision Portal, primarily those that utilize the time-bound device onboarding token feature.
Is there a workaround for CVE-2024-8100?
A temporary workaround for CVE-2024-8100 includes revoking affected onboarding tokens until the software can be updated.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/arista
- canonical/arista cloudvision