Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2025-0505

On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Arista

Description

On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Arista Networks CloudVision Portal

Default version status: unaffected

  • 2024.2.0 to ≤ 2024.2.1affected
  • 2024.3.0affected

References