Arista EOS (redundant supervisor, RPR/SSO): On modular chassis with dual supervisors running RPR or SSO redundancy

Impact

On modular chassis with dual supervisors running RPR or SSO redundancy, an existing unprivileged user can log in to the standby supervisor as root. The standby has full access to the chassis state and becomes the active supervisor on failover, so this is a straight unprivileged-to-root path on your largest, most central switches — typically the spines.

Who can reach it

Authenticated but unprivileged user with network access to the standby supervisor.

What to do

EOS upgrade. Requires a reload of the supervisors — do the standby first, fail over, then the former active, which keeps the chassis forwarding throughout. Until patched, restrict management reachability to the standby supervisor's address.

References