How to remediate – Arista Networks Device Detection

1. Introduction

An Arista Networks device was detected on your network. Nessus identified version information via SSH login or SNMP services. This indicates a potential exposure to known vulnerabilities affecting Arista devices, and could allow attackers to gain unauthorized access or disrupt service. Confidentiality, integrity, and availability may be impacted if exploited.

2. Technical Explanation

Nessus identifies Arista Networks devices by successfully obtaining version information through standard network protocols like SSH and SNMP. This detection doesn’t represent an active exploit but confirms the presence of a device that *could* be vulnerable to known exploits if not properly patched or configured. There is no specific CVE associated with this detection; it’s a reconnaissance finding. An attacker could use this information to target the device with appropriate exploits based on its identified version.

• Root cause: The Arista Networks device is reachable and responds to SSH/SNMP queries, revealing its presence and version.
• Exploit mechanism: An attacker uses the discovered version information to search for known vulnerabilities applicable to that specific Arista EOS version. They then attempt to exploit these vulnerabilities using publicly available tools or custom scripts.
• Scope: All Arista Networks devices running any supported EOS version are potentially in scope, depending on their configuration and patch level.

3. Detection and Assessment

• Quick checks: Use SSH to connect to the device and run `show version`. Alternatively, use SNMP walk tools to query system information.
• Scanning: Nessus vulnerability scans will identify Arista devices and report any known vulnerabilities based on the detected EOS version. Other scanners like OpenVAS may also provide similar results.
• Logs and evidence: Examine SSH logs for connections to the device’s IP address. Check SNMP trap destinations for traffic originating from the device.

show version

4. Solution / Remediation Steps

Apply precise steps to mitigate potential vulnerabilities on Arista devices. Prioritize patching and secure configuration practices.

4.1 Preparation

• Services: No services need to be stopped for most updates, but plan for potential brief interruptions during patch application.
• Dependencies: Ensure sufficient disk space is available for patch downloads and installation. Roll back by restoring the pre-update configuration backup if issues occur.
• Change window: Coordinate changes with network operations teams during a scheduled maintenance window.

4.2 Implementation

1. Step 1: Download the latest EOS version from the Arista support portal (https://www.arista.com/en/).
2. Step 2: Upload the EOS image to the device using TFTP or SCP.
3. Step 3: Activate the new EOS version using the `install` command in the Arista CLI.
4. Step 4: Verify the installation and reboot the device if prompted.

4.3 Config or Code Example

Before

show version
Arista EOS version 4.21.0F

After

show version
Arista EOS version 4.25.2A

4.4 Security Practices Relevant to This Vulnerability

Implement security practices that directly address this vulnerability type. Focus on patch management, secure configuration, and network segmentation.

• Patch cadence: Regularly update EOS versions to the latest stable release to address known vulnerabilities.
• Least privilege: Limit SSH access to authorized personnel only, using strong authentication methods like key-based authentication.
• Network Segmentation: Isolate Arista devices on a separate network segment to limit the impact of potential breaches.

4.5 Automation (Optional)

# Example Ansible playbook snippet - use with caution!
- name: Upgrade Arista EOS version
  hosts: arista_devices
  tasks:
    - name: Download EOS image
      get_url:
        url: "http://your_tftp_server/eos.bin"
        dest: /tmp/eos.bin
    - name: Install new EOS version
      arista.eos.eos_command:
        commands: install activate boot system flash:/tmp/eos.bin
  

5. Verification / Validation

Confirm the fix worked by verifying the updated EOS version and performing a smoke test of key services.

• Post-fix check: Run `show version` in the Arista CLI and confirm the output displays the expected new EOS version (e.g., 4.25.2A).
• Re-test: Re-run the Nessus scan to verify that any previously identified vulnerabilities related to the older EOS version are no longer reported.
• Monitoring: Monitor system logs for errors or unexpected behavior following the upgrade.

show version
Arista EOS version 4.25.2A

6. Preventive Measures and Monitoring

Suggest only measures that are relevant to the vulnerability type. Use “for example” to keep advice conditional, not prescriptive.

• Baselines: Implement a security baseline for Arista EOS configurations, including strong passwords, SSH key authentication, and disabling unnecessary services.
• Pipelines: Integrate automated configuration checks into CI/CD pipelines to ensure compliance with the security baseline.
• Asset and patch process: Establish a regular patch review cycle (e.g., monthly) to identify and apply EOS updates promptly.

7. Risks, Side Effects, and Roll Back

• Roll back: Restore the pre-upgrade configuration backup using the Arista CLI. If necessary, contact Arista support for assistance.

8. References and Resources

• Vendor advisory or bulletin: https://www.arista.com/en/