CVE-2024-9132

CVE-2024-9132 is a high-severity vulnerability (CVSS 8.1, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) classified under CWE-94 (code injection), affecting Arista Networks software. It stems from the ability of administrators to configure an insecure captive portal script, potentially enabling arbitrary code execution.

Remote attackers with network access can exploit this vulnerability, requiring high attack complexity but no privileges or user interaction. Successful exploitation grants high-impact confidentiality, integrity, and availability effects, allowing attackers to inject and execute malicious code through the misconfigured captive portal script.

Arista has issued Security Advisory-0105, available at https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105, which provides details on affected versions and recommended mitigations or patches.