CVE-2020-9015 in the critical feed json
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow…
published 2020-02-20 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-29846
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 16.5%
- EPSS 16.5% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Metasploit
Summary
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands
Timeline
- First public exploit (Metasploit exploit/unix/ssh/arista_tacplus_shell)
- Published
Exploit prediction
16.46% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/unix/ssh/arista_tacplus_shell Arista restricted shell escape (with privesc) metasploit exploit, great rank, 2020-02-02
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
Sources
- CVE List CVE-2020-9015
- NVD CVE-2020-9015
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.