{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2025-0505",
        "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "state": "PUBLISHED",
        "assignerShortName": "Arista",
        "dateReserved": "2025-01-15T19:34:32.801Z",
        "datePublished": "2025-05-08T18:37:13.981Z",
        "dateUpdated": "2025-05-08T18:56:19.850Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "product": "CloudVision Portal",
                    "vendor": "Arista Networks",
                    "versions": [
                        {
                            "lessThanOrEqual": "2024.2.1",
                            "status": "affected",
                            "version": "2024.2.0",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "2024.3.0",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "configurations": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>Zero Touch Provisioning is enabled by default on CloudVision Portal, as such there are no configuration settings specific to this vulnerability.</p><p>The CloudVision versions listed in the “Affected Software” section above are vulnerable. In order to determine your software version, navigate to the Settings page on the CloudVision UI.</p><p><img alt=\"\" src=\"https://www.arista.com/assets/images/article/SA115-1.png\"></p><br>"
                        }
                    ],
                    "value": "Zero Touch Provisioning is enabled by default on CloudVision Portal, as such there are no configuration settings specific to this vulnerability.\n\nThe CloudVision versions listed in the “Affected Software” section above are vulnerable. In order to determine your software version, navigate to the Settings page on the CloudVision UI."
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<span style=\"background-color: rgb(255, 255, 255);\">On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.</span><br>"
                        }
                    ],
                    "value": "On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-233",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-233 Privilege Escalation"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "NONE",
                        "baseScore": 10,
                        "baseSeverity": "CRITICAL",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "privilegesRequired": "NONE",
                        "scope": "CHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-269",
                            "description": "CWE-269 Improper Privilege Management",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
                "shortName": "Arista",
                "dateUpdated": "2025-05-08T18:37:13.981Z"
            },
            "references": [
                {
                    "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21315-security-advisory-0115"
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.io/help/2024.3/articles/dXBncmFkZS5BbGwudXBncmFkZQ==#dXBncmFkZUN2cA==-upgrading-a-cluster\">Upgrade | Setup Guide | Arista CloudVision 2024.3 Help Center</a></p><div>&nbsp;</div><div>CVE-2025-0505 has been fixed in the following releases:</div><ul><ul><ul><li>2024.2.2 and later releases in the 2024.2.x train</li><li>2024.3.1 and later releases in the 2024.3.x train</li></ul></ul></ul><br>"
                        }
                    ],
                    "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see  Upgrade | Setup Guide | Arista CloudVision 2024.3 Help Center https://www.arista.io/help/2024.3/articles/dXBncmFkZS5BbGwudXBncmFkZQ==#dXBncmFkZUN2cA==-upgrading-a-cluster \n\n \n\nCVE-2025-0505 has been fixed in the following releases:\n\n  *  2024.2.2 and later releases in the 2024.2.x train\n  *  2024.3.1 and later releases in the 2024.3.x train"
                }
            ],
            "source": {
                "advisory": "115",
                "defect": [
                    "BUG 1046170"
                ],
                "discovery": "INTERNAL"
            },
            "title": "On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state",
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p>The ZTP component on CloudVision (on-premise) can be disabled by running the following on any of the nodes of the CloudVision deployment (Note that this will disable the Zero Touch Provisioning feature on CloudVision):</p><pre>cvpi disable ztp\ncvpi stop ztp\n</pre><div>&nbsp;</div><p>The following command can be used to verify that the component is stopped:</p><pre>cvpi status ztp\n \nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary  components total:1 running:0 disabled:1\n</pre><div>&nbsp;</div><p>The component may be enabled after upgrading to one the remediated software versions (See<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/support/advisories-notices/security-advisory/21315-security-advisory-0115#pageLink-1\">&nbsp;Resolution</a>) using the following commands:</p><pre>cvpi enable ztp\ncvpi start ztp</pre><br>"
                        }
                    ],
                    "value": "The ZTP component on CloudVision (on-premise) can be disabled by running the following on any of the nodes of the CloudVision deployment (Note that this will disable the Zero Touch Provisioning feature on CloudVision):\n\ncvpi disable ztp\ncvpi stop ztp\n\n\n \n\nThe following command can be used to verify that the component is stopped:\n\ncvpi status ztp\n \nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary  components total:1 running:0 disabled:1\n\n\n \n\nThe component may be enabled after upgrading to one the remediated software versions (See  Resolution https://www.arista.com/en/support/advisories-notices/security-advisory/21315-security-advisory-0115#pageLink-1 ) using the following commands:\n\ncvpi enable ztp\ncvpi start ztp"
                }
            ],
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-05-08T18:55:39.942468Z",
                                "id": "CVE-2025-0505",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "yes"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-05-08T18:56:19.850Z"
                }
            }
        ]
    }
}