CVE-2021-28503
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2021
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Arista EOS
- Vendor
- Arista Networks
- Product
- Arista EOS
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| EOS-4.23 | affected | custom | EOS-4.23.10 | Unavailable | None listed |
| EOS-4.24 | affected | custom | EOS-4.24.8 | Unavailable | None listed |
| EOS-4.25 | affected | custom | EOS-4.25.6 | Unavailable | None listed |
| EOS-4.26 | affected | custom | EOS-4.26.3 | Unavailable | None listed |