Database/Control plane, storage & DevOps
Arista CloudVision (Zero Touch Provisioning): Zero Touch Provisioning can be abused to obtain admin privileges
Impact
Zero Touch Provisioning can be abused to obtain admin privileges on the CloudVision system itself. ZTP is by design an unauthenticated-ish onboarding path — a new switch shows up and asks for its config — so this turns 'plug a device into the provisioning VLAN' into 'own the fabric controller'. For anyone doing rack-and-stack at scale, which is every GPU buildout, the ZTP network is live constantly.
Who can reach it
A device that can participate in ZTP against the CloudVision instance — i.e. anything on the provisioning network. Physical or logical access to that VLAN is the whole requirement.
What to do
Upgrade CloudVision. Beyond the patch, treat the ZTP/provisioning VLAN as a privileged network: separate it from the general management network, keep it shut down when not actively provisioning, and require MAC/serial allowlisting. Those are config and process changes and they are what actually keeps this closed.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.