CVE-2024-47519
Arista Ng Firewall ≤ 17.1.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LSummary
CVE-2024-47519 is a high-severity Key Exchange without Entity Authentication (CWE-322) vulnerability in Arista Ng Firewall. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-47519 is a vulnerability where backup uploads to ETM are subject to man-in-the-middle (MITM) interception, assigned CWE-322 (Key Exchange without Entity Authentication). It affects Arista products, as detailed in the vendor's security advisory. The vulnerability received a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and limited availability.
An attacker with low privileges (such as an authenticated user) and network access can exploit this vulnerability remotely without user interaction. By performing a MITM attack on backup uploads to ETM, the attacker can intercept sensitive backup data (high confidentiality impact), modify it (high integrity impact), and potentially cause limited disruption (low availability impact).
Arista's security advisory (https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105) provides details on mitigations and patches for addressing this issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42723
Vulnerability Data
Backup uploads to ETM subject to man-in-the-middle interception
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
Requiring device identification and authentication before establishing connections prevents unauthenticated key exchanges with unknown devices.
Requiring unique identification and authentication of users before any privileged action stops key exchange from occurring with unauthenticated parties.
Requiring identification and authentication of non-organizational users blocks key exchange with unauthenticated external actors.
Requiring proper cryptographic key establishment and management directly stops unauthenticated key-exchange implementations.
Issuing or obtaining PKI certificates under an approved policy supplies the entity authentication missing from unauthenticated key exchange.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication of services/hardware prevents unauthenticated key exchange.
Identity proofing and binding directly supports verifying actors before key exchange.
Verifying identity assertions mitigates the missing entity authentication in key exchange.
Protecting data-in-transit implies use of authenticated key exchange but does not explicitly require entity authentication.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography mandates authenticated key-exchange mechanisms, directly addressing the lack of entity authentication.
Security testing can detect missing entity authentication during key exchange.
Secure authentication directly prevents unauthenticated key exchange by requiring verified identities before keys are established.
Identity management provides the verified identities required before key exchange occurs.
Network security policies can require authenticated channels, indirectly reducing the risk of unauthenticated key exchange.
Security of network services includes requirements for authenticated key exchange in service protocols.