CVE-2024-12829: Arista NG Firewall RCE Vulnerability

CVE-2024-12829 Overview

CVE-2024-12829 is a command injection vulnerability in Arista NG Firewall that permits authenticated remote attackers to execute arbitrary operating system commands. The flaw resides in the ExecManagerImpl class, which passes a user-supplied string to a system call without proper validation. Successful exploitation grants code execution in the context of root, giving attackers complete control of the firewall appliance. The issue was reported through the Zero Day Initiative as ZDI-CAN-24015 and tracked in advisory ZDI-24-1717. It affects Arista NG Firewall version 17.1.1 and is categorized under [CWE-78] (OS Command Injection).

Critical Impact
An authenticated attacker on the network can achieve root-level remote code execution on the firewall, compromising perimeter defenses and any traffic they inspect.

Affected Products

Arista NG Firewall 17.1.1
Deployments exposing the management interface over the network
Environments where low-privileged users hold authenticated access

Discovery Timeline

2024-12-20 - CVE-2024-12829 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12829

Vulnerability Analysis

The vulnerability exists in the ExecManagerImpl class of Arista NG Firewall. The class constructs a system command using input received from an authenticated user, then executes that command through a shell without sanitizing or escaping metacharacters. Attackers can append shell operators such as ;, |, or backticks to the input to break out of the intended argument and inject arbitrary commands. Because the firewall service runs as root, injected commands inherit those privileges, resulting in full appliance compromise. Full technical details are available in the Zero Day Initiative Advisory ZDI-24-1717.

Root Cause

The root cause is missing input validation in ExecManagerImpl before the class uses the string in a system call. The code trusts caller-supplied data as safely quoted command arguments, violating the [CWE-78] rule that untrusted data must never reach a shell invocation unescaped. There is no allowlist, no argument tokenization, and no privilege separation between the request handler and the shell execution routine.

Attack Vector

Exploitation requires network access to the firewall management service and valid credentials for any account that can reach the vulnerable endpoint. The attacker submits a crafted string containing shell metacharacters. ExecManagerImpl concatenates the string into a command and invokes it, causing the injected payload to run as root. No user interaction is required after authentication, and attack complexity is low.

No verified public exploit code is available at this time. Refer to the ZDI advisory for technical specifics.

Detection Methods for CVE-2024-12829

Indicators of Compromise

Unexpected child processes of the NG Firewall Java service, especially sh, bash, wget, curl, nc, or python
New or modified files under administrative directories such as /usr/share/untangle/ or /var/lib/untangle-*
Outbound connections from the firewall appliance to unfamiliar hosts shortly after administrative API activity
New cron entries, systemd units, or SSH authorized_keys additions on the firewall

Detection Strategies

Alert on process lineage where the NG Firewall daemon spawns interactive shells or scripting interpreters
Inspect application and audit logs for API requests containing shell metacharacters such as ;, &&, |, $(, or backticks
Correlate authenticated management sessions with subsequent outbound traffic originating from the firewall itself

Monitoring Recommendations

Forward NG Firewall audit and syslog data to a centralized SIEM for behavioral analysis
Baseline normal administrative activity and flag deviations in command execution frequency and source IP
Monitor for privilege-sensitive file changes and new listening services on firewall appliances

How to Mitigate CVE-2024-12829

Immediate Actions Required

Upgrade Arista NG Firewall to the fixed release as directed by Arista once available; review the ZDI-24-1717 advisory for vendor coordination status
Restrict management interface access to a dedicated administrative network or VPN
Rotate all administrative credentials and audit accounts that can reach the vulnerable endpoint
Review firewall audit logs for suspicious API calls dating back to before the CVE publication date

Patch Information

Refer to Arista's product security notices for a fixed version of NG Firewall. The Zero Day Initiative advisory ZDI-24-1717 tracks vendor coordination. Apply the vendor-supplied update to all affected 17.1.1 installations and validate the fix in a staging environment before production rollout.

Workarounds

Limit access to the management plane using network access control lists so only trusted administrator hosts can reach it
Enforce strong, unique credentials and multi-factor authentication for all firewall administrative accounts
Reduce the number of accounts with any level of authenticated access to the appliance until a patch is applied
Monitor and alert on any process launched by the firewall service that is not part of the documented baseline

bash

# Example: restrict management access to a dedicated admin subnet
# Replace 10.10.50.0/24 with your administrative network
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP