Vulnerability · Published Oct 21, 2021 · Assigned by Arista
CVE-2021-28496In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.
Medium 5.7
In plain English
A medium-severity security flaw in Arista EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | Arista EOS | EOS-4.22 – through EOS-4.22.12EOS-4.23 – before EOS-4.23.10EOS-4.24 – before EOS-4.24.8EOS-4.25 – before EOS-4.25.5EOS-4.26 – before EOS-4.26.2 |
Weakness: CWE-311 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H