CVE-2021-28496: arista networks arista eos Missing Encryption of Sensitive Data
Vulnerability summary
CVE-2021-28496 is a medium (CVSS 6.5) Missing Encryption of Sensitive Data vulnerability in arista networks arista eos. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.8% of scored vulnerabilities.
Timeline
- 21-10-2021PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA5.7MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Arista1 product
- eos≥ 4.22, ≤ 4.22.7m | ≥ 4.23, < 4.23.10 | ≥ 4.24, < 4.24.8 | ≥ 4.25, < 4.25.5 | ≥ 4.26, < 4.26.2
Arista networks1 product
- arista eos≥ EOS-4.22, ≤ EOS-4.22.12 | ≥ EOS-4.23, < EOS-4.23.10 | ≥ EOS-4.24, < EOS-4.24.8 | ≥ EOS-4.25, < EOS-4.25.5 | ≥ EOS-4.26, < EOS-4.26.2
2 vendors · 2 products
References
1 links- www.arista.com/en/support/advisories-notices/security-advisories/13243-security-advisory-0069X Refsource MISCVendor Advisory