Arista CloudVision Portal (on-premise): An authenticated CloudVision user can take actions on managed EOS devices well

Impact

An authenticated CloudVision user can take actions on managed EOS devices well beyond what their role should allow. CloudVision is the fabric's configuration and streaming-telemetry brain, so 'broader actions than intended' means pushing configlets to switches you were never granted. In a shared operations model — a neocloud with tenant-facing NOC accounts, or an MSP — this collapses the internal privilege model for the entire fabric.

Who can reach it

Any authenticated CloudVision Portal user on an on-premise deployment.

What to do

Upgrade CloudVision Portal. Application upgrade on the CVP cluster; the switches keep forwarding. Afterwards review the CVP change log for configlet pushes that did not come from an authorized operator — that audit is the real work.

References