CVE-2021-28501 Explained : Impact and Mitigation
Discover the impact of CVE-2021-28501, a critical vulnerability in Arista EOS allowing unrestricted access for local users. Learn about the affected systems, exploitation, and mitigation steps.
A critical vulnerability has been identified in Arista EOS that could allow local users to gain unrestricted access to the device. This CVE, assigned the ID CVE-2021-28501, was published on January 11, 2022, with a CVSS base score of 9.1.
Understanding CVE-2021-28501
This section delves into the details of the CVE-2021-28501 vulnerability in Arista EOS.
What is CVE-2021-28501?
The issue arises from the incorrect use of EOS's AAA API by the OpenConfig and TerminAttr agents, potentially granting unauthorized access to devices configured with nopassword.
The Impact of CVE-2021-28501
With a CVSS base score of 9.1, this critical vulnerability poses a high risk as it could lead to unrestricted access to affected devices for local users.
Technical Details of CVE-2021-28501
Explore the technical aspects surrounding CVE-2021-28501 in Arista EOS.
Vulnerability Description
The vulnerability stems from improper use of EOS's AAA API by certain agents, resulting in a significant security loophole.
Affected Systems and Versions
Arista TerminAttr version 1.16.2 is impacted by this vulnerability, potentially exposing devices to unauthorized access.
Exploitation Mechanism
The vulnerability allows local users configured with nopassword to gain unrestricted access to affected devices, posing a severe security risk.
Mitigation and Prevention
Learn how to protect your systems from the CVE-2021-28501 vulnerability.
Immediate Steps to Take
To mitigate the risks, it is crucial to upgrade to TerminAttr v1.16.2 or later releases as recommended by Arista Networks.
Long-Term Security Practices
Disabling OpenConfig gNMI/gNOI and RESTCONF along with TerminAttr can help mitigate vulnerabilities on affected versions, or a hotfix using a proxy service can be deployed.
Patching and Updates
For continued use of affected agents, deploying a proxy service configured behind the server can provide a temporary solution. The hotfix for mitigation can be downloaded from Arista's official website to safeguard your systems.