CVE-2024-8100: On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.

Published May 8, 2025

Updated

On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.

Affected Software

1 affected component

Arista CloudVision Portal

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see CVP Software downloads https://www.arista.com/en/support/software-download CVE-2024-8100 has been fixed in the following releases: * 2024.1.3 and later releases in the 2024.1.x train * 2024.2.2 and later releases in the 2024.2.x train * 2024.3.1 and later releases in the 2024.3.x train * 2025.1.0 and later releases in the 2025.1.x train

Event History

May 8, 2025

CVE Published

via MITRE·06:31 PM

Data Sourced

via MITRE·06:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-8100?

CVE-2024-8100 has a high severity rating due to its potential to allow unauthorized admin access to the Arista CloudVision Portal.

How do I fix CVE-2024-8100?

To mitigate CVE-2024-8100, update to the latest version of the Arista CloudVision Portal that addresses this vulnerability.

What are the impacts of CVE-2024-8100?

CVE-2024-8100 can allow an attacker to use a compromised onboarding token to gain full administrative privileges on the Arista CloudVision Portal.

Which versions of Arista CloudVision are affected by CVE-2024-8100?

CVE-2024-8100 affects specific versions of the Arista CloudVision Portal, primarily those that utilize the time-bound device onboarding token feature.

Is there a workaround for CVE-2024-8100?

A temporary workaround for CVE-2024-8100 includes revoking affected onboarding tokens until the software can be updated.