CVE-2021-28510

Exploit

EPSS 0.22%
Published 26.01.2023 21:15:22
Last modified 21.11.2024 05:59:48
Source psirt@arista.com
Teams watchlist Login
Open Login

For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.

Affected products Warnungen 0 Metrics 3 CWE 2 References 4

Data is provided by the National Vulnerability Database (NVD)

Arista ≫ Eos Version < 4.23.10

   Arista ≫ 7020r Version-
   Arista ≫ 7050cx3-32s Version-
   Arista ≫ 7050cx3m-32s Version-
   Arista ≫ 7050qx-32s Version-
   Arista ≫ 7050qx2-32s Version-
   Arista ≫ 7050sx-128 Version-
   Arista ≫ 7050sx-64 Version-
   Arista ≫ 7050sx-72q Version-
   Arista ≫ 7050sx2-128 Version-
   Arista ≫ 7050sx2-72q Version-
   Arista ≫ 7050sx3-48c8 Version-
   Arista ≫ 7050sx3-48yc Version-
   Arista ≫ 7050sx3-48yc12 Version-
   Arista ≫ 7050sx3-48yc8 Version-
   Arista ≫ 7050sx3-96yc8 Version-
   Arista ≫ 7050tx-48 Version-
   Arista ≫ 7050tx-64 Version-
   Arista ≫ 7050tx-72q Version-
   Arista ≫ 7050tx2-128 Version-
   Arista ≫ 7050tx3-48c8 Version-
   Arista ≫ 7060cx-32s Version-
   Arista ≫ 7060cx2-32s Version-
   Arista ≫ 7060dx4-32 Version-
   Arista ≫ 7060px4-32 Version-
   Arista ≫ 7060sx2-48yc6 Version-
   Arista ≫ 7150s-24 Version-
   Arista ≫ 7150s-52 Version-
   Arista ≫ 7150s-64 Version-
   Arista ≫ 7150sc-24 Version-
   Arista ≫ 7150sc-64 Version-
   Arista ≫ 7170-32c Version-
   Arista ≫ 7170-32cd Version-
   Arista ≫ 7170-64c Version-
   Arista ≫ 720xp-24y6 Version-
   Arista ≫ 720xp-24zy4 Version-
   Arista ≫ 720xp-48y6 Version-
   Arista ≫ 720xp-48zc2 Version-
   Arista ≫ 720xp-96zc2 Version-
   Arista ≫ 7250qx-64 Version-
   Arista ≫ 7260cx Version-
   Arista ≫ 7260cx3 Version-
   Arista ≫ 7260cx3-64 Version-
   Arista ≫ 7260qx Version-
   Arista ≫ 7280e Version-
   Arista ≫ 7280r Version-
   Arista ≫ 7280r2 Version-
   Arista ≫ 7280r3 Version-
   Arista ≫ 7280sr3-48yc8 Version-
   Arista ≫ 7280sr3k-48yc8 Version-
   Arista ≫ 7300x-32q Version-
   Arista ≫ 7300x-64s Version-
   Arista ≫ 7300x-64t Version-
   Arista ≫ 7300x3-32c Version-
   Arista ≫ 7300x3-48yc4 Version-
   Arista ≫ 7304x3 Version-
   Arista ≫ 7308x3 Version-
   Arista ≫ 7320x-32c Version-
   Arista ≫ 7324x Version-
   Arista ≫ 7328x Version-
   Arista ≫ 7368x4 Version-
   Arista ≫ 7500e Version-
   Arista ≫ 7500r Version-
   Arista ≫ 7500r2 Version-
   Arista ≫ 7500r3 Version-
   Arista ≫ 7500r3-24d Version-
   Arista ≫ 7500r3-24p Version-
   Arista ≫ 7500r3-36cq Version-
   Arista ≫ 7500r3k-36cq Version-
   Arista ≫ 7504r3 Version-
   Arista ≫ 7508r3 Version-
   Arista ≫ 7512r3 Version-
   Arista ≫ 7800r3-36p Version-
   Arista ≫ 7800r3-48cq Version-
   Arista ≫ 7800r3k-48cq Version-
   Arista ≫ 7804r3 Version-
   Arista ≫ 7808r3 Version-

Arista ≫ Eos Version >= 4.24.0 < 4.24.8

Arista ≫ Eos Version >= 4.25.0 < 4.25.6

Arista ≫ Eos Version >= 4.26.0 < 4.26.4

Arista ≫ Eos Version >= 4.27.0 < 4.27.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.22%	0.422

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
psirt@arista.com	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-1284 Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

https://www.arista.com/en/support/advisories-notices/security-advisory/15439-security-advisory-0076

Vendor Advisory

Exploit

Mitigation

https://nvd.nist.gov/vuln/detail/CVE-2021-28510

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-28510

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-28510

EUVD