CVE-2023-24512
📋 TL;DR
This vulnerability allows authenticated attackers with gNMI access to modify arbitrary configurations on Arista EOS switches when the Streaming Telemetry Agent (TerminAttr) is enabled with gNMI configured. This affects Arista EOS users who have enabled gNMI over the Streaming Telemetry Agent, typically when streaming to third-party systems (not the default CloudVision configuration).
💻 Affected Systems
- Arista EOS
📦 What is this software?
Ceos Lab by Arista
Cloudeos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
Veos Lab by Arista
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise through unauthorized configuration changes, including routing manipulation, access control bypass, or denial of service.
Likely Case
Unauthorized configuration changes leading to network instability, data leakage, or privilege escalation.
If Mitigated
Limited impact if proper access controls and network segmentation are implemented.
🎯 Exploit Status
Requires authenticated gNMI access. Exploitation involves crafting specific gNMI requests to modify configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Arista security advisory for specific fixed versions per platform
Vendor Advisory: https://www.arista.com/en/support/advisories-notices/security-advisory/17250-security-advisory-0086
Restart Required: Yes
Instructions:
1. Review Arista security advisory for fixed versions. 2. Upgrade affected EOS versions to patched releases. 3. Restart switches after upgrade.
🔧 Temporary Workarounds
Disable gNMI on Streaming Telemetry Agent
allRemove gNMI configuration from the TerminAttr agent if not required for operations.
configure terminal
no daemon TerminAttr
no management api gnmi
Restrict gNMI Access
allImplement strict access controls and network segmentation for gNMI endpoints.
configure terminal
management api gnmi
shutdown
no shutdown vrf management
🧯 If You Can't Patch
- Disable gNMI access on Streaming Telemetry Agent if not required
- Implement strict network segmentation and access controls for gNMI endpoints
🔍 How to Verify
Check if Vulnerable:
Check if TerminAttr agent is enabled with gNMI configuration using 'show running-config | include TerminAttr' and 'show management api gnmi'Check Version:
show versionVerify Fix Applied:
Verify EOS version is patched using 'show version' and confirm gNMI configuration is properly secured📡 Detection & Monitoring
Log Indicators:
- Unauthorized gNMI configuration change attempts
- Unexpected configuration modifications via gNMI
Network Indicators:
- Unusual gNMI traffic patterns
- Configuration changes from unauthorized sources
SIEM Query:
source="arista-switch" AND ("gnmi" OR "TerminAttr") AND ("config" OR "set")