CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2021-28500

CVSS 9.1v3.1pub. 2022-01-14upd. 2024-11-21

An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Arista Eos

    OS
    Arista
    < 4.204.21.0 – 4.21.14m4.22.0 – 4.22.11m4.23.0 – 4.23.8m4.24.6.0 – 4.24.6m4.25.0 – 4.25.4m4.26.0 – 4.26.1f
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2014-7169CRITICAL9.8⚠ KEVPL ✓same product

GNU Bash — niekompletna łatka Shellshock umożliwia command injection (CVE-2014-7169)

CVE-2014-6271CRITICAL9.8⚠ KEVPL ✓same product

ShellShock — RCE poprzez zmienne środowiskowe w GNU Bash

CVE-2023-24509CRITICAL9.3PL ✓same product

Arista EOS: privilege escalation na redundantnym module supervisor

CVE-2021-28506CRITICAL9.1PL ✓same product

Arista EOS: pominięcie autoryzacji w gNOI API umożliwia reset urządzenia

CVE-2020-10188CRITICAL9.8PL ✓same product

Buffer overflow w telnetd (netkit) umożliwiający zdalne wykonanie kodu