PT-2021-17871 · Arista · Arista Metamako Operating System

Published 2021-09-09 · Updated 2021-09-22 · CVE-2021-28495

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Arista Metamako Operating System versions MOS-0.1x train through MOS-0.13 and post releases Arista Metamako Operating System versions MOS-0.26.6 and below in the MOS-0.2x train Arista Metamako Operating System versions MOS-0.31.1 and below in the MOS-0.3x train

Description: The issue affects Arista's MOS software, which is supported on the 7130 product line. Under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs.

Recommendations: For versions MOS-0.1x train through MOS-0.13 and post releases, consider disabling API access via the JSON-RPC APIs until a patch is available. For versions MOS-0.26.6 and below in the MOS-0.2x train, restrict access to the JSON-RPC APIs to minimize the risk of exploitation. For versions MOS-0.31.1 and below in the MOS-0.3x train, avoid using the JSON-RPC APIs for user authentication until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-28495

Affected Products

Arista Metamako Operating System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-28495 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28495 · Vendor Advisory
• https://arista.com/en/support/advisories-notices/security-advisories/12914-security-advisory-66 · Vendor Advisory
• https://t.me/cibsecurity/28571 · Telegram Post
• https://t.me/cvenotify/21286 · Telegram Post