Paper/Archive/CVE-2021-28501

CVE-2021-28501

Arista Networks Terminattr — An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

EPSS 0.8%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 58.0.580 × 2011.6 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

Affected

ProductAffectedFixed inSource

Terminattr1.16.2 0–CNA

Scores by source

Arista (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refarista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071