9.1

CVE-2021-28500

Exploit

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

Data is provided by the National Vulnerability Database (NVD)
Arista ≫ Eos Version < 4.20
Arista ≫ Eos Version >= 4.21.0 <= 4.21.14m
Arista ≫ Eos Version >= 4.22.0 <= 4.22.11m
Arista ≫ Eos Version >= 4.23.0 <= 4.23.8m
Arista ≫ Eos Version >= 4.24.6.0 <= 4.24.6m
Arista ≫ Eos Version >= 4.25.0 <= 4.25.4m
Arista ≫ Eos Version >= 4.26.0 <= 4.26.1f
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.31% 0.515
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
psirt@arista.com 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.