CVE-2023-24546: arista cloudvision_portal Improper Access Control
Vulnerability summary
CVE-2023-24546 is a high (CVSS 8.1) Improper Access Control vulnerability in arista cloudvision_portal. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.6% of scored vulnerabilities.
Timeline
- 13-06-2023PublishedVulnerability first disclosed.
- 06-01-2025Last modifiedVulnerability information updated.
Description
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system than intended. This advisory impacts the Arista CloudVision Portal product when run on-premise. It does not impact CloudVision as-a-Service.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Arista1 product
- cloudvision_portal≥ 2021.1, ≤ 2021.3 | 2022.1.0 | 2022.1.1 | 2022.2.0 | 2022.2.1 | 2022.3.0
1 vendor · 1 product