CVE-2021-28496

In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.

State: Published
Severity: 5.7 Medium
Published: Oct 21, 2021
Updated: Sep 16, 2024
Reserved: Mar 16, 2021

Read the record on cve.org

Description

On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	Arista

Weaknesses

CWE-311 Missing Encryption of Sensitive Data

Affected Products

Product	Versions
Arista EOSArista Networks	EOS-4.22 through EOS-4.22.12Affected EOS-4.23 to before EOS-4.23.10Affected EOS-4.24 to before EOS-4.24.8Affected EOS-4.25 to before EOS-4.25.5Affected EOS-4.26 to before EOS-4.26.2Affected

References

https://www.arista.com/en/support/advisories-notices/security-advisories/13243-security-advisory-0069

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.