CloudVision CUE vulnerabilities
6 known vulnerabilities in CloudVision CUE from Arista Networks. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
CloudVision CUE: Authentication Bypass by Spoofing
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
- 7.2 High severity
CloudVision CUE: Improper Neutralization of Special Elements used in an OS Command
An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.
- 9.8 Critical severity
CloudVision CUE: Missing Authentication for Critical Functionality
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
- 8.5 High severity
CloudVision CUE: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.
- 8.7 High severity
CloudVision CUE: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to
- 8.4 High severity
CloudVision CUE: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affec