CVE-2021-28498
📋 TL;DR
Arista MOS software stores user enable passwords in clear text, allowing unprivileged users to gain complete system access. This affects Arista 7130 product line running vulnerable MOS versions. Attackers can escalate privileges to administrative control.
💻 Affected Systems
- Arista 7130 product line
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, enabling data theft, network manipulation, and persistent backdoor installation.
Likely Case
Privilege escalation from limited user to full administrative control, allowing configuration changes and unauthorized access.
If Mitigated
Limited impact if proper access controls and monitoring prevent unauthorized users from accessing password storage.
🎯 Exploit Status
Exploitation requires some level of user access to read clear text passwords. No public exploit code available but trivial for attackers with access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MOS-0.26.7+, MOS-0.31.2+, and later versions
Vendor Advisory: https://www.arista.com/en/support/advisories-notices/security-advisories/12912-security-advisory-64
Restart Required: Yes
Instructions:
1. Check current MOS version. 2. Download appropriate patched version from Arista support portal. 3. Apply update following Arista upgrade procedures. 4. Restart system to activate fix.
🔧 Temporary Workarounds
Restrict User Access
allLimit user accounts to only necessary personnel and implement least privilege access controls.
Monitor Password Access
allImplement logging and monitoring for attempts to access password storage locations.
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the system
- Monitor for privilege escalation attempts and review user activity logs regularly
🔍 How to Verify
Check if Vulnerable:
Check MOS version using 'show version' command and compare against affected versions list.Check Version:
show versionVerify Fix Applied:
After patching, verify version is updated to patched release and test that enable passwords are no longer stored in clear text.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to password files
- Privilege escalation events
- Unexpected user privilege changes
Network Indicators:
- Unusual administrative access patterns
- Configuration changes from non-admin users
SIEM Query:
search 'user privilege escalation' OR 'unauthorized admin access' on affected Arista devices