CVE-2021-28496

In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.

View on CVE.org

Published Oct 21, 2021 CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Description

On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Arista Networks

Arista EOS

affected

Version	Status	Constraints
`EOS-4.22`	affected	≤ EOS-4.22.12
`EOS-4.23`	affected	< EOS-4.23.10
`EOS-4.24`	affected	< EOS-4.24.8
`EOS-4.25`	affected	< EOS-4.25.5
`EOS-4.26`	affected	< EOS-4.26.2

Configuration 1 [-]

OR	cpe:2.3:o:arista:eos::::::::
	cpe:2.3:o:arista:eos::::::::
	cpe:2.3:o:arista:eos::::::::
	cpe:2.3:o:arista:eos::::::::
	cpe:2.3:o:arista:eos::::::::

No data.

No data available yet.

Remediation

Vendor Solution

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. The vulnerability is fixed in the following EOS versions: 4.23.10 and later releases 4.24.8 and later releases 4.25.5 and later releases 4.26.2 and later releases

Vendor Workaround

The restriction of access to the related CLI show command of specified role type can be used as an immediate mitigation. The detailed instructions of role-based authorization can be found at https://www.arista.com/um-eos/eos-user-security#xx1347683.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2021-15172	On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.430% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://www.arista.com/en/support/advisories-notices/security-advisories/13243-security-advisory-0069

History

Sep 16, 2024 5:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.	In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.