A vulnerability in Arista DANZ Monitoring Fabric allows authenticated, restricted users to perform unauthorized access to internal host services via SSH port forwarding.

This is an incorrect permission assignment (CWE-732) flaw where restricted users are permitted to utilize SSH port forwarding. This functionality allows an authenticated user with limited privileges to tunnel traffic to services that should be isolated from their security context.

The ability for a restricted user to access host-internal services poses a significant risk to data confidentiality and system integrity. With a CVSS score of 7.5, this high-severity vulnerability could allow an attacker to pivot into sensitive management interfaces or internal network segments, potentially leading to full system compromise or lateral movement within the infrastructure.

Immediate Action: Upgrade your Arista software to the recommended versions, such as DMF 8.7.1, 8.6.2, or 8.5.3, as specified in the official Arista security advisory.

Proactive Monitoring: Review SSH access logs for suspicious port forwarding requests or unusual connection patterns originating from restricted user accounts.

Compensating Controls: Restrict SSH access to management interfaces to trusted IP addresses only and enforce the principle of least privilege by auditing user account roles within the fabric.

Public Exploit Available: No (exploit_available: false)

Given the potential for privilege escalation and unauthorized internal access, organizations should prioritize patching affected Arista systems. Administrators must evaluate their current version against the Arista security advisory and schedule maintenance windows to apply the necessary firmware updates as soon as possible.