CVE-2021-28503

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Score

CVSS 3.1 9.8 Critical

Status

Modified - psirt@arista.com

Published

2022-02-04

Last modified

2024-09-16

Weaknesses

CWE-287, CWE-305

Affected products

• Eos (Arista)
• Arista Eos (Arista Networks)

References

• https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072