Paper/Archive/CVE-2025-0505

CVE-2025-0505

Arista Networks CloudVision Portal — On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state

EPSS 0.7%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 51.5.515 × 2010.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.

Affected

ProductAffectedFixed inSource

CloudVision Portal2024.2.0 – 2024.2.1–CNA

CloudVision Portal2024.3.0–CNA

Scores by source

Arista (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refarista.com/en/support/advisories-notices/security-advisory/21315-security-advisory-0115