Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2021-28503

In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Arista

Description

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Arista Networks Arista EOS

  • EOS-4.23 to < EOS-4.23.10affected
  • EOS-4.24 to < EOS-4.24.8affected
  • EOS-4.25 to < EOS-4.25.6affected
  • EOS-4.26 to < EOS-4.26.3affected

References