CVE-2021-28503 HIGH

CVE-2021-28503: In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Vendor Arista Networks

Product Arista EOS

Weakness CWE-305

Published February 4, 2022

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Key dates

02Disclosure timeline

February 4, 2022 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-28503 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/305.html

Related vulnerabilities

Identifiers

CVE CVE-2021-28503

CWE CWE-305

CVSS 7.4 / HIGH

Affected versions

Vendor Arista Networks

Product Arista EOS

Affected ≥ EOS-4.23 and < EOS-4.23.10

Vendor Arista Networks

Product Arista EOS

Affected ≥ EOS-4.24 and < EOS-4.24.8

Vendor Arista Networks

Product Arista EOS

Affected ≥ EOS-4.25 and < EOS-4.25.6

Vendor Arista Networks

Product Arista EOS

Affected ≥ EOS-4.26 and < EOS-4.26.3

CVE-2021-28503: In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

01Description

02Disclosure timeline

03References

04Related CVE