CVE-2021-28505

{"containers": {"cna": {"affected": [{"product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.26.0", "status": "affected", "version": "4.26.3M", "versionType": "custom"}, {"lessThanOrEqual": "4.27.0", "status": "affected", "version": "4.27.0F", "versionType": "custom"}]}], "datePublic": "2022-03-29T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-14T20:05:50.000Z", "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073"}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience.\nArtista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2021-28505 has been fixed in the following releases:\n\n4.26.4M and later releases in the 4.26.x train\n4.27.1F and later releases in the 4.27.x train"}], "source": {"advisory": "73", "defect": ["BUG", "609752"], "discovery": "INTERNAL"}, "title": "On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.", "workarounds": [{"lang": "en", "value": "Replace \"vxlan\" IP protocol match with match on IP protocol \"udp\" and Layer 4 destination port for VxLAN encapsulated packets i.e 4789. < br/> If VXLAN L4 destination port number is not the default 4789 then use the configured L4 destination port number."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@arista.com", "DATE_PUBLIC": "2022-03-29T21:53:00.000Z", "ID": "CVE-2021-28505", "STATE": "PUBLIC", "TITLE": "On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "EOS", "version": {"version_data": [{"version_affected": "<=", "version_name": "4.26.3M", "version_value": "4.26.0"}, {"version_affected": "<=", "version_name": "4.27.0F", "version_value": "4.27.0"}]}}]}, "vendor_name": "Arista Networks"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073", "refsource": "MISC", "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073"}]}, "solution": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience.\nArtista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2021-28505 has been fixed in the following releases:\n\n4.26.4M and later releases in the 4.26.x train\n4.27.1F and later releases in the 4.27.x train"}], "source": {"advisory": "73", "defect": ["BUG", "609752"], "discovery": "INTERNAL"}, "work_around": [{"lang": "en", "value": "Replace \"vxlan\" IP protocol match with match on IP protocol \"udp\" and Layer 4 destination port for VxLAN encapsulated packets i.e 4789. < br/> If VXLAN L4 destination port number is not the default 4789 then use the configured L4 destination port number."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:47:32.647Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073"}]}]}, "cveMetadata": {"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "assignerShortName": "Arista", "cveId": "CVE-2021-28505", "datePublished": "2022-04-14T20:05:50.059Z", "dateReserved": "2021-03-16T00:00:00.000Z", "dateUpdated": "2024-09-16T16:58:06.559Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.26.0", "status": "affected", "version": "4.26.3M", "versionType": "custom"}, {"lessThanOrEqual": "4.27.0", "status": "affected", "version": "4.27.0F", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A8E9397-1B74-4A40-B8E3-7088A5A45749", "versionEndExcluding": "4.26.4m", "versionStartIncluding": "4.26", "vulnerable": true}, {"criteria": "cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*", "matchCriteriaId": "F85F865B-F425-46DD-B9D4-C96AE100F39F", "versionEndExcluding": "4.27.1f", "versionStartIncluding": "4.27", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:arista:ccs-710p-12:-:*:*:*:*:*:*:*", "matchCriteriaId": "3671762A-7E5C-47BF-AE10-64F19C82EEDF", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-710p-16p:-:*:*:*:*:*:*:*", "matchCriteriaId": "AC8C4306-2090-4170-B316-79613AA19392", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-720xp-24y6:-:*:*:*:*:*:*:*", "matchCriteriaId": "45460268-9775-4047-B36D-1A62480047C7", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-720xp-24zy4:-:*:*:*:*:*:*:*", "matchCriteriaId": "7A3886D9-AB47-4E4B-95E6-39E31100FE62", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-720xp-48y6:-:*:*:*:*:*:*:*", "matchCriteriaId": "4D21D207-AD0F-4745-B123-A7219DD6512F", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-720xp-48zc2:-:*:*:*:*:*:*:*", "matchCriteriaId": "B317039B-7365-4348-8286-39128C4B363F", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-720xp-96zc2:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E58B31B-C6C1-4EDC-8D4F-1528C9B1CB8A", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-722xpm-48y4:-:*:*:*:*:*:*:*", "matchCriteriaId": "074CBF00-1D2C-4388-874A-62453B1D4564", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:ccs-722xpm-48zy8:-:*:*:*:*:*:*:*", "matchCriteriaId": "D15C1D00-5F35-4F67-8075-D84D3BD9CE73", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7010tx-48:-:*:*:*:*:*:*:*", "matchCriteriaId": "9CB43CD4-C96F-483C-B743-3D81C9A65EDF", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7050cx3-32s:-:*:*:*:*:*:*:*", "matchCriteriaId": "E7C133EA-753A-4770-AEF8-11AC8E901F1A", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7050cx3m-32s:-:*:*:*:*:*:*:*", "matchCriteriaId": "5D11D6B9-1E68-4A65-A9CD-8DD299EC6B25", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7050sx3-48c8:-:*:*:*:*:*:*:*", "matchCriteriaId": "11B7A876-587F-4C51-BE49-C82F6508C536", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7050sx3-48yc12:-:*:*:*:*:*:*:*", "matchCriteriaId": "EEB629B5-7E62-4972-A288-EF76FFA3E441", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7050sx3-48yc8:-:*:*:*:*:*:*:*", "matchCriteriaId": "33079D44-2255-4682-A4BC-4B071D8EDCFA", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7050sx3-96yc8:-:*:*:*:*:*:*:*", "matchCriteriaId": "69F1C5CA-19D7-4F40-93EB-97F44DCD5DCB", "vulnerable": false}, {"criteria": "cpe:2.3:h:arista:dcs-7050tx3-48c8:-:*:*:*:*:*:*:*", "matchCriteriaId": "418E2ED9-B9FC-438D-9F7C-8D6DB7E297AA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol."}, {"lang": "es", "value": "En las plataformas Arista EOS afectadas, si se presenta una regla de coincidencia VXLAN en una lista de acceso IPv4 que es aplicada a la entrada de un puerto/SVI L2 o L3, la regla VXLAN y las reglas ACL posteriores en esa lista de acceso ignorar\u00e1n el protocolo IP especificado"}], "id": "CVE-2021-28505", "lastModified": "2026-06-17T03:46:28.943", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "psirt@arista.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-14T21:15:08.427", "references": [{"source": "psirt@arista.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@arista.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}