Paper/Archive/CVE-2021-28500

CVE-2021-28500

Arista Networks Arista EOS — An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

EPSS 0.8%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 57.0.570 × 2011.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

Affected

ProductAffectedFixed inSource

Arista EOS4.26.1F – 4.26.0–CNA

Arista EOS4.25.4.M – 4.25.0–CNA

Arista EOS4.24.6M – 4.24.6.0–CNA

Arista EOS4.23.8M – 4.23.0–CNA

Arista EOS4.22.11M – 4.22.0–CNA

Arista EOS4.21.14M – 4.21.0–CNA

Arista EOS4.20 – < 00CNA

Scores by source

Arista (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refarista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071