CVE-2021-28500 Vulnerability Details

  /     /     /  

CVE-2021-28500 Metadata Quick Info

CVE Published: 14/01/2022 | CVE Updated: 16/09/2024 | CVE Year: 2021
Source: Arista | Vendor: Arista Networks | Product: Arista EOS
Status : PUBLISHED

---

CVE-2021-28500 Description

An issue has recently been discovered in Arista EOS where the incorrect use of EOS\'s AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

Metrics

CVSS Version: 3.1 | Base Score: 9.1 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-285
CWE Name: CWE-285 Improper Authorization
Source: Arista Networks

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).