CVE-2024-12830

Deeper analysis

Arista NG Firewall contains a directory traversal vulnerability in the custom_handler method that permits remote code execution. The flaw stems from insufficient validation of user-supplied paths before they are used in file operations, allowing an unauthenticated attacker to write or execute files under the www-data user context. The issue was originally tracked as ZDI-CAN-24019 and carries a CVSS 3.1 base score of 7.3 with CWE-22.

Remote attackers can exploit the vulnerability over the network without authentication or user interaction to achieve arbitrary code execution on affected Arista NG Firewall installations. Successful exploitation grants the attacker the ability to run commands in the context of the web server process, potentially leading to further system compromise.

The single referenced advisory from the Zero Day Initiative provides technical details on the flaw but does not include explicit mitigation steps in the supplied information. The associated EPSS score reached a modest peak of 0.0538 before receding to its current value of 0.0416, indicating limited post-disclosure exploitation interest.