CVE-2021-28506: arista networks eos Improper Authorization
CVSS: 9.4v2.0HighModified
Published 14-01-2022Last modified 16-09-2024
Vulnerability summary
CVE-2021-28506 is a high (CVSS 9.4) Improper Authorization vulnerability in arista networks eos. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.4/10
010
High · v2.0 (NVD)EPSS score
1.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 14-01-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HSourcesAll 2 agree
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
High 9.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:C/A:CSourcesSingle source
EPSS trend
Probability
1.42%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.42% on 19-09-2026
19-09-202619-10-2026
EPSS score1.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (arista.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Arista1 product
- eos≥ 4.24.0, ≤ 4.24.7m | ≥ 4.25.0, ≤ 4.25.3 | ≥ 4.25.4, ≤ 4.25.4m | ≥ 4.25.5, ≤ 4.25.5.1m | ≥ 4.26.0, ≤ 4.26.2f
Arista networks1 product
- eos≥ 4.26.2F, ≤ 4.26.0 | ≥ 4.25.5.1M, ≤ 4.25.5 | ≥ 4.25.4M, ≤ 4.25.4 | ≥ 4.25.3, ≤ 4.25.0 | ≥ 4.24.7M, ≤ 4.24.2F
2 vendors · 2 products
References
1 links- www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071X Refsource MISCExploitMitigationPatchVendor Advisory