Arista無線APのC-260とC-250に脆弱性、修正版なし
Summary
Aristaの無線LANアクセスポイントC-260とC-250に、全台共通の固定鍵でファームウェア検証を破られる脆弱性が見つかり、修正版はありません。両機種を使う組織は、Aristaが示す回避策を早めに適用してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Aristaの無線LANアクセスポイントC-260とC-250に、全台共通の固定鍵でファームウェア検証を破られる脆弱性が見つかり、修正版はありません。両機種を使う組織は、Aristaが示す回避策を早めに適用してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Arista NetworksWi-Fi Access Point |
≥ 1.0.0 (no fix yet)→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web arista.com
- web nvd.nist.gov
- web github.com