CVE-2021-28503

In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

State: Published
Severity: 7.4 High
Published: Feb 4, 2022
Updated: Sep 16, 2024
Reserved: Mar 16, 2021

Read the record on cve.org

Description

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H	Arista

Weaknesses

CWE-305 Authentication Bypass by Primary Weakness

Affected Products

Product	Versions
Arista EOSArista Networks	EOS-4.23 to before EOS-4.23.10Affected EOS-4.24 to before EOS-4.24.8Affected EOS-4.25 to before EOS-4.25.6Affected EOS-4.26 to before EOS-4.26.3Affected

References

https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.