CVE-2021-28508

TerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP

State: Published
Severity: 6.8 Medium
Published: May 26, 2022
Updated: Sep 16, 2024
Reserved: Mar 16, 2021

Description

This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak IPsec sensitive data in clear text in CVP to other authorized users, which could cause IPsec traffic to be decrypted or modified by other authorized users on the device.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H	Arista

Weaknesses

CWE-255 Credentials Management

Affected Products

Product	Versions
Arista EOSArista Networks	4.23 through 4.23.11Affected 4.24 through 4.24.9Affected 4.25 through 4.25.7Affected 4.26 through 4.26.5Affected 4.27 through 4.27.3Affected
Arista TerminAttrArista Networks	v1.10 through v1.10.10Affected v1.16 through v1.16.7Affected v1.18 through v1.18.1Affected

References

https://www.arista.com/en/support/advisories-notices/security-advisories/15484-security-advisory-0077

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.