CVE-2024-47519

CVE-2024-47519 is a vulnerability where backup uploads to ETM are subject to man-in-the-middle (MITM) interception, assigned CWE-322 (Key Exchange without Entity Authentication). It affects Arista products, as detailed in the vendor's security advisory. The vulnerability received a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and limited availability.

An attacker with low privileges (such as an authenticated user) and network access can exploit this vulnerability remotely without user interaction. By performing a MITM attack on backup uploads to ETM, the attacker can intercept sensitive backup data (high confidentiality impact), modify it (high integrity impact), and potentially cause limited disruption (low availability impact).

Arista's security advisory (https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105) provides details on mitigations and patches for addressing this issue.