CVE-2021-28500 : What You Need to Know
Discover the impact and mitigation strategies for CVE-2021-28500, a critical vulnerability in Arista EOS allowing unrestricted access due to AAA API misuse by local users.
An in-depth look at the recently discovered vulnerability in Arista EOS that could allow local users with nopassword configuration to gain unrestricted access to the device due to the misuse of AAA API's.
Understanding CVE-2021-28500
This section delves into the specifics of the CVE-2021-28500 vulnerability found in Arista EOS.
What is CVE-2021-28500?
CVE-2021-28500 involves the incorrect use of Arista EOS's AAA API by OpenConfig and TerminAttr agents, potentially granting local users with nopassword configuration unrestricted access to the device.
The Impact of CVE-2021-28500
The impact of this critical vulnerability is high, with a base severity score of 9.1 (Critical) due to the ease of exploitation and the possibility of unauthorized access.
Technical Details of CVE-2021-28500
Explore the technical aspects surrounding CVE-2021-28500 to gain a better understanding of the vulnerability.
Vulnerability Description
The vulnerability arises from the misuse of EOS's AAA API by specific agents, leading to unauthorized access for local users with nopassword configuration.
Affected Systems and Versions
Arista EOS versions 4.26.1F, 4.25.4.M, 4.24.6M, 4.23.8M, 4.22.11M, 4.21.14M, and 4.20 are impacted by CVE-2021-28500.
Exploitation Mechanism
Exploiting this vulnerability involves leveraging the incorrect use of AAA API's, enabling unauthorized access for local users.
Mitigation and Prevention
Discover the necessary steps to mitigate and prevent the exploitation of CVE-2021-28500 for enhanced security.
Immediate Steps to Take
Ensure local users have secure authentication, enforce password policies, and remove any instances of nopassword configurations.
Long-Term Security Practices
Implement regular software updates and security patches to address vulnerabilities and enhance system security.
Patching and Updates
Upgrade to the recommended software versions that address CVE-2021-28500 across the affected Arista EOS releases, including 4.26.2F, 4.25.5M, 4.24.7M, 4.23.9M, 4.22.12M, and 4.21.15M.