Arista Edge Threat Management Backup Uploads Vulnerable to Man-in-the-Middle Interception

A vulnerability exists in Arista Edge Threat Management (ETM) Backup uploads to the Arista NG Firewall (NGFW) that allows for man-in-the-middle interception. This issue affects all NGFW versions through 17.1.1. When the Configuration Backup service is enabled, backups can be intercepted during the upload process to ETM.

Impact

Exploitation of this vulnerability could lead to unauthorized interception of backup data during uploads to Edge Threat Management.

Reproduction

To reproduce this vulnerability, an administrator must log into the Arista NG Firewall user interface and navigate to the Apps and Services page. If the Configuration Backup service is not installed or is disabled, the system is not vulnerable. Once the service is confirmed to be active, the administrator can initiate a backup, which will then be subject to interception while being uploaded to Edge Threat Management.

Remediation

The recommended action is to disable the Configuration Backup application. After disabling, ensure to save the changes.