Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2021-28500

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Arista

Description

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Arista Networks Arista EOS

  • 4.26.1F to ≤ 4.26.0affected
  • 4.25.4.M to ≤ 4.25.0affected
  • 4.24.6M to ≤ 4.24.6.0affected
  • 4.23.8M to ≤ 4.23.0affected
  • 4.22.11M to ≤ 4.22.0affected
  • 4.21.14M to ≤ 4.21.0affected
  • 4.20 to < 0affected

References