Skip to content
OpenAdvisories
High · 7.4 CVE-2021-28503 EUVD-2021-15179GHSA-mvw4-rrm9-fqfc

In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Published Feb 4, 2022 · Updated Sep 16, 2024 · Assigned by Arista

Vendor: Arista Networks Product: Arista EOS Category: Network devices

Description

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Affected products

VendorProductAffectedFixed
Arista Networks Arista EOS EOS-4.23 – < EOS-4.23.10, EOS-4.24 – < EOS-4.24.8, EOS-4.25 – < EOS-4.25.6, EOS-4.26 – < EOS-4.26.3 EOS-4.23.10

References