CVEvulnerability

CVE-2021-28506

9.1 CRITICAL Published 2022-01-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-01-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
9.4 HIGH — AV:N/AC:L/Au:N/C:N/I:C/A:C
Weaknesses
CWE-285, CWE-306, CWE-862

Description

An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.

Affected configurations

• arista eos (>= 4.24.0 <= 4.24.7m) • arista eos (>= 4.25.0 <= 4.25.3) • arista eos (>= 4.25.4 <= 4.25.4m) • arista eos (>= 4.25.5 <= 4.25.5.1m) • arista eos (>= 4.26.0 <= 4.26.2f)

Related

Weakness · CWE (3)

  • CWE-285 Improper Authorization weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-862 Missing Authorization weakness

References