CVE-2024-4578 - CVE House
Back to Database
Status published High CVE-2024-4578

Privilege escalation in Arista Wireless Access Points

Vulnerability Description

This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “config” user is able to cause a privilege escalation via spawning a bash shell. The SSH CLI session does not require high permissions to exploit this vulnerability, but the config password is required to establish the session. The spawned shell is able to obtain root privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-4578

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Arista would like to acknowledge and thank David Miller from cyllective AG (https://cyllective.com) for responsibly reporting CVE-2024-4578

References

More from Arista Networks

View All →
CVE-2025-8873
Arista EOS Dataplane Denial of Service via Malformed IPsec Packet
High 8.7
CVE-2025-8872
A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted
High 7.1
CVE-2025-8870
On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.
Medium 5.6
CVE-2025-7048
On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption o
Medium 5.3
CVE-2025-6980
Captive Portal can expose sensitive information
High 7.5

Affected Vendor

Arista Networks

View all reports →

Affected Software

Arista Wireless Access Points
Vulnerable Versions:
13.0.2.x, 15.x, 16.x

Timeline

Official Publish: June 27th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-77

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1105 Ingress Tool Transfer
Command and Control