PT-2021-17872 · Arista · Arista Eos+1

Published 2021-10-19 · Updated 2022-07-30 · CVE-2021-28496

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Arista EOS and CloudEOS versions 4.22.x through 4.26.1

Description: The password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. This issue occurs when using shared secret profiles.

Recommendations: For versions 4.22.x through 4.23.9, consider disabling the use of shared secret profiles until a patch is available. For versions 4.24.0 through 4.24.7, restrict access to eAPI and other JSON outputs to minimize the risk of exploitation. For versions 4.25.0 through 4.25.4, avoid using the password variable in the affected JSON outputs until the issue is resolved. For versions 4.26.0 through 4.26.1, consider temporarily disabling the BFD feature to prevent password leakage.

Fix

Missing Encryption of Sensitive Data

Insufficiently Protected Credentials

Weakness Enumeration

CWE-311

CWE-522

Related Identifiers

CVE-2021-28496

Affected Products

Arista Eos

Cloudeos

References · 5

• https://osv.dev/vulnerability/CVE-2021-28496 · Vendor Advisory
• https://arista.com/en/support/advisories-notices/security-advisories/13243-security-advisory-0069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28496 · Security Note
• https://t.me/cvenotify/34040 · Telegram Post
• https://t.me/cibsecurity/30962 · Telegram Post