CVE-2024-47520: Arista NG Firewall Auth Bypass Flaw

CVE-2024-47520 Overview

CVE-2024-47520 affects Arista NG Firewall, where a user granted access to the advanced report application can perform actions outside their authorized scope. The flaw is categorized under [CWE-653] (Improper Isolation or Compartmentalization) and stems from insufficient enforcement of privilege boundaries within the reporting component. An authenticated attacker with low-level report privileges can leverage the weakness to impact confidentiality, integrity, and, to a limited extent, availability of the firewall management plane.

Critical Impact
An authenticated user with advanced report access can execute unauthorized actions on the NG Firewall management interface, breaching intended privilege boundaries and exposing sensitive network security controls.

Affected Products

Arista NG Firewall (all versions prior to the vendor-supplied fix)
Deployments exposing the advanced report application to multiple user roles
Environments relying on role-based access control within NG Firewall reporting

Discovery Timeline

2025-01-10 - CVE-2024-47520 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database
Vendor Advisory - Published as Arista Security Advisory #0105

Technical Details for CVE-2024-47520

Vulnerability Analysis

The vulnerability resides in the advanced report application shipped with Arista NG Firewall. The component fails to properly isolate privileged operations from users who only require read-oriented reporting access. Because the report application shares its execution context with higher-privilege administrative functions, an authenticated user can trigger actions that should be restricted to firewall administrators.

Exploitation requires network access to the NG Firewall management interface, valid credentials for the advanced report role, and user interaction to reach the vulnerable workflow. Successful exploitation impacts confidentiality and integrity, with limited availability impact on the affected instance.

Root Cause

The defect maps to [CWE-653] Improper Isolation or Compartmentalization. Administrative and reporting functions execute within a shared authorization boundary in the report application. The component does not perform granular privilege checks before invoking sensitive operations, so a report-level session inherits capabilities intended for higher-privileged accounts.

Attack Vector

An attacker first obtains credentials with advanced report application rights, either through legitimate assignment, credential theft, or an insider scenario. The attacker then authenticates to the NG Firewall web interface and navigates the advanced report workflows to invoke functions outside their assigned role. Because the flaw does not require administrative privileges, delegated report users become a viable pivot point into the firewall management plane.

No public proof-of-concept exploit has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability sits at 0.414%. Technical exploitation details are described in prose only; see the Arista Security Advisory #0105 for vendor-specific analysis.

Detection Methods for CVE-2024-47520

Indicators of Compromise

Advanced report user sessions invoking administrative endpoints outside typical reporting workflows
Unexpected configuration changes or policy modifications correlated with non-administrative accounts
Audit log entries showing privileged actions initiated from accounts limited to the report application
Repeated access to sensitive report endpoints followed by state-changing HTTP requests

Detection Strategies

Baseline normal advanced report user behavior and alert on deviations that touch configuration or policy APIs
Correlate authentication events with subsequent privileged actions to identify role boundary violations
Monitor NG Firewall audit trails for actions that do not match the acting user's assigned role

Monitoring Recommendations

Forward NG Firewall administrative and report audit logs to a centralized SIEM for role-versus-action correlation
Alert on any write, delete, or configuration API calls performed by accounts scoped to reporting
Track logon geolocation and session duration for report application accounts to identify credential misuse

How to Mitigate CVE-2024-47520

Immediate Actions Required

Apply the fixed release referenced in Arista Security Advisory #0105 as soon as maintenance windows allow
Audit all accounts granted advanced report application rights and revoke access that is not strictly required
Rotate credentials for advanced report users and enforce multi-factor authentication on the management interface
Restrict management-plane network access to trusted administrative subnets and jump hosts

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0105. Administrators should upgrade to the fixed NG Firewall release identified in the advisory. Verify the running version after the upgrade and re-test role-based access to confirm that report users can no longer invoke administrative actions.

Workarounds

Remove or reduce the advanced report application role assignment for non-administrative users until patching completes
Segment the NG Firewall management network so only vetted administrators can reach the web interface
Increase audit log retention and review frequency for the report application during the exposure window

bash

# Configuration example
# Refer to Arista Security Advisory #0105 for the exact upgrade path
# https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105