CVE-2021-28503

Published: Feb 4, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Affected (5)

Products: Arista: Eos

Arista

1 product

Eos

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Arista Eos	4.22 ≤ version ≤ 4.22.9m
Arista Eos	4.23 ≤ version ≤ 4.23.9
Arista Eos	4.24 ≤ version ≤ 4.24.7
Arista Eos	4.25 ≤ version ≤ 4.25.5
Arista Eos	4.26 ≤ version ≤ 4.26.2

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-305

Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

References (2)

https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072

Source: psirt@arista.com

MitigationPatchVendor Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationPatchVendor Advisory

Timeline

No history available yet.