CVE-2024-12830: RCE in Arista NG Firewall

Successful exploitation of CVE-2024-12830 allows an attacker to gain complete control over the affected Arista NG Firewall. This includes the ability to modify system configurations, steal sensitive data, and potentially pivot to other systems within the network. Given the lack of authentication required, the vulnerability presents a significant risk, particularly in environments with exposed management interfaces. The attacker executes code as the www-data user, which may have elevated privileges depending on the firewall’s configuration. This vulnerability shares similarities with other directory traversal vulnerabilities where improper path sanitization leads to arbitrary code execution.

1. Reserved2024-12-19
2. Published2024-12-20
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-12830 is to upgrade to a patched version of Arista NG Firewall as soon as possible. Until an upgrade is feasible, consider implementing strict network segmentation to limit external access to the firewall’s management interface. Web Application Firewall (WAF) rules can be configured to block requests containing suspicious file paths or directory traversal sequences. Monitor firewall logs for unusual activity, particularly requests targeting the customhandler endpoint. After upgrading, verify the fix by attempting to access the customhandler endpoint with a crafted path designed to trigger the vulnerability; it should be rejected.