漏洞标题
在受影响的平台上运行Aristo EOS时，具有执行 gNMI 请求权限的授权攻击者可以创建一个允许它更新交换机任意配置的请求。
漏洞描述信息
在运行Arista EOS的受影响平台上，一个授权攻击者，如果具有执行gNMI请求的权限，可以构造一个请求，允许它更新交换机中的任意配置。
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
漏洞类别
N/A
漏洞标题
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.
漏洞描述信息
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
访问控制不恰当
漏洞标题
Arista EOS 访问控制错误漏洞
漏洞描述信息
Arista EOS是美国Arista公司的一个完全可编程的、高度模块化的、基于Linux的网络操作系统。 Arista EOS存在访问控制错误漏洞。攻击者利用该漏洞可以更新交换机中的任意配置。
CVSS信息
N/A
漏洞类别
授权问题