7.5

CVE-2021-28504

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as expected.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Arista ≫ Eos Version >= 4.26 < 4.26.4m
   Arista ≫ Ccs-710p-12 Version-
   Arista ≫ Ccs-710p-16p Version-
   Arista ≫ Ccs-720xp-24y6 Version-
   Arista ≫ Ccs-720xp-24zy4 Version-
   Arista ≫ Ccs-720xp-48y6 Version-
   Arista ≫ Ccs-720xp-48zc2 Version-
   Arista ≫ Ccs-720xp-96zc2 Version-
   Arista ≫ Ccs-722xpm-48y4 Version-
   Arista ≫ Ccs-722xpm-48zy8 Version-
   Arista ≫ Dcs-7010tx-48 Version-
   Arista ≫ Dcs-7050cx3-32s Version-
   Arista ≫ Dcs-7050cx3m-32s Version-
   Arista ≫ Dcs-7050sx3-48c8 Version-
   Arista ≫ Dcs-7050sx3-48yc12 Version-
   Arista ≫ Dcs-7050sx3-48yc8 Version-
   Arista ≫ Dcs-7050sx3-96yc8 Version-
   Arista ≫ Dcs-7050tx3-48c8 Version-
Arista ≫ Eos Version >= 4.27 < 4.27.1f
   Arista ≫ Ccs-710p-12 Version-
   Arista ≫ Ccs-710p-16p Version-
   Arista ≫ Ccs-720xp-24y6 Version-
   Arista ≫ Ccs-720xp-24zy4 Version-
   Arista ≫ Ccs-720xp-48y6 Version-
   Arista ≫ Ccs-720xp-48zc2 Version-
   Arista ≫ Ccs-720xp-96zc2 Version-
   Arista ≫ Ccs-722xpm-48y4 Version-
   Arista ≫ Ccs-722xpm-48zy8 Version-
   Arista ≫ Dcs-7010tx-48 Version-
   Arista ≫ Dcs-7050cx3-32s Version-
   Arista ≫ Dcs-7050cx3m-32s Version-
   Arista ≫ Dcs-7050sx3-48c8 Version-
   Arista ≫ Dcs-7050sx3-48yc12 Version-
   Arista ≫ Dcs-7050sx3-48yc8 Version-
   Arista ≫ Dcs-7050sx3-96yc8 Version-
   Arista ≫ Dcs-7050tx3-48c8 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.408
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
psirt@arista.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.