Description
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arista Networks | CloudVision CUE | 2021.2.0 – ≤ 2026.2.0 | — |