#VU102353 Path traversal in Arista Edge Threat Management - Arista NG Firewall (NGFW) - CVE-2024-12830

Vulnerability identifier: #VU102353

Vulnerability risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-12830

CWE-ID: CWE-22

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Arista Edge Threat Management - Arista NG Firewall (NGFW)
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Arista Networks

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the implementation of the custom_handler method. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system, leading to arbitrary code execution.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Arista Edge Threat Management - Arista NG Firewall (NGFW): All versions

---

External links
https://www.zerodayinitiative.com/advisories/ZDI-24-1718/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.