CVE-2024-47518: Arista NG Firewall Information Disclosure

CVE-2024-47518 Overview

CVE-2024-47518 affects Arista NG Firewall, where specially constructed queries targeting the Event Trace Manager (ETM) can disclose information about active remote access sessions. The vulnerability is classified under [CWE-552] (Files or Directories Accessible to External Parties) and stems from insufficient access controls on ETM query interfaces. An authenticated attacker with low privileges can send crafted network queries to enumerate active remote sessions on the firewall.

Critical Impact
Authenticated attackers can enumerate active remote access sessions on Arista NG Firewall, exposing session metadata that supports lateral movement and follow-on attacks.

Affected Products

Arista NG Firewall (all versions prior to the fixed release referenced in Arista Security Advisory #0105)
Deployments exposing ETM query interfaces to authenticated network users
Environments where NG Firewall mediates remote access sessions

Discovery Timeline

2025-01-10 - CVE-2024-47518 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47518

Vulnerability Analysis

The flaw resides in the Event Trace Manager (ETM) component of Arista NG Firewall. ETM handles diagnostic and telemetry queries used for troubleshooting session state and firewall events. The vulnerability allows a low-privilege authenticated user to craft queries that return data about active remote access sessions, including session metadata that should be restricted to administrators.

The disclosed information can be used to profile connected users, identify session identifiers, and stage subsequent attacks against remote access infrastructure. The confidentiality impact is high, while integrity and availability impacts remain limited.

Root Cause

The root cause is improper access control on ETM query endpoints, mapped to [CWE-552]. ETM query handlers do not enforce sufficient authorization checks before returning session records. As a result, authenticated queries designed to target session data structures succeed regardless of the caller's role.

Attack Vector

Exploitation requires network access and valid low-privilege credentials on the NG Firewall management plane. The attacker constructs targeted ETM queries and submits them through the standard query interface. No user interaction is required, and the attack complexity is low. See the Arista Security Advisory #0105 for the vendor's technical description.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA KEV catalog. The EPSS probability is 0.428%.

Detection Methods for CVE-2024-47518

Indicators of Compromise

Unexpected ETM query traffic originating from low-privilege user accounts against NG Firewall management interfaces
Repeated or automated queries referencing session identifiers, remote access tables, or ETM diagnostic namespaces
Authentication events for non-administrative accounts followed by bursts of diagnostic queries

Detection Strategies

Audit NG Firewall management logs for ETM queries executed by accounts that lack an operational need for diagnostic data
Correlate account role with query type to flag privilege-inconsistent activity
Baseline normal ETM query patterns and alert on deviations in volume or query composition

Monitoring Recommendations

Forward NG Firewall audit and management-plane logs to a centralized SIEM for correlation with identity events
Monitor for enumeration patterns consistent with session discovery, such as sequential session identifier probing
Track authentication anomalies on the firewall management interface, including new sources and unusual hours

How to Mitigate CVE-2024-47518

Immediate Actions Required

Apply the fixed release identified in Arista Security Advisory #0105
Restrict management-plane access to the NG Firewall to trusted administrative networks only
Review and reduce the number of low-privilege accounts with access to ETM or diagnostic query interfaces
Rotate credentials for any accounts suspected of misuse prior to patching

Patch Information

Arista has issued a security advisory with fixed software versions for NG Firewall. Refer to Arista Security Advisory #0105 for the specific fixed releases and upgrade procedures. Apply the vendor patch to eliminate the underlying access control gap in ETM.

Workarounds

Limit access to the NG Firewall management interface using network ACLs until patching is complete
Disable or restrict ETM query access for non-administrative roles where operationally feasible
Enforce multi-factor authentication on all firewall management accounts to reduce credential misuse risk

bash

# Configuration example: restrict management access via ACL
# Consult Arista NG Firewall documentation for exact syntax in your version
# 1. Limit management plane to administrator subnet only
# 2. Remove diagnostic query permissions from non-admin roles
# 3. Verify by attempting an ETM query from a low-privilege account