7.5

CVE-2021-28504

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as expected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Arista ≫ Eos Version >= 4.26 < 4.26.4m
   Arista ≫ Ccs-710p-12 Version -
   Arista ≫ Ccs-710p-16p Version -
   Arista ≫ Ccs-720xp-24y6 Version -
   Arista ≫ Ccs-720xp-24zy4 Version -
   Arista ≫ Ccs-720xp-48y6 Version -
   Arista ≫ Ccs-720xp-48zc2 Version -
   Arista ≫ Ccs-720xp-96zc2 Version -
   Arista ≫ Ccs-722xpm-48y4 Version -
   Arista ≫ Ccs-722xpm-48zy8 Version -
   Arista ≫ Dcs-7010tx-48 Version -
   Arista ≫ Dcs-7050cx3-32s Version -
   Arista ≫ Dcs-7050cx3m-32s Version -
   Arista ≫ Dcs-7050sx3-48c8 Version -
   Arista ≫ Dcs-7050sx3-48yc12 Version -
   Arista ≫ Dcs-7050sx3-48yc8 Version -
   Arista ≫ Dcs-7050sx3-96yc8 Version -
   Arista ≫ Dcs-7050tx3-48c8 Version -
Arista ≫ Eos Version >= 4.27 < 4.27.1f
   Arista ≫ Ccs-710p-12 Version -
   Arista ≫ Ccs-710p-16p Version -
   Arista ≫ Ccs-720xp-24y6 Version -
   Arista ≫ Ccs-720xp-24zy4 Version -
   Arista ≫ Ccs-720xp-48y6 Version -
   Arista ≫ Ccs-720xp-48zc2 Version -
   Arista ≫ Ccs-720xp-96zc2 Version -
   Arista ≫ Ccs-722xpm-48y4 Version -
   Arista ≫ Ccs-722xpm-48zy8 Version -
   Arista ≫ Dcs-7010tx-48 Version -
   Arista ≫ Dcs-7050cx3-32s Version -
   Arista ≫ Dcs-7050cx3m-32s Version -
   Arista ≫ Dcs-7050sx3-48c8 Version -
   Arista ≫ Dcs-7050sx3-48yc12 Version -
   Arista ≫ Dcs-7050sx3-48yc8 Version -
   Arista ≫ Dcs-7050sx3-96yc8 Version -
   Arista ≫ Dcs-7050tx3-48c8 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.72% 0.504
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
psirt@arista.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073
Vendor Advisory
Mitigation