Vulnerability CVE-2021-28500
Published: 2022-01-14

Description:
An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API??s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

Type:

CWE-863

 (Incorrect Authorization)

CVSS2 => (AV:L/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.9/10
10/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Arista -> EOS 

 References:
https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
Copyright 2024, cxsecurity.com

 

Back to Top