CVE-2021-28500
📋 TL;DR
This vulnerability in Arista EOS allows local users with 'nopassword' configuration to gain unrestricted access to network devices due to incorrect AAA API usage by OpenConfig and TerminAttr agents. It affects Arista switches and routers running vulnerable EOS versions. Attackers could bypass authentication controls and gain administrative privileges.
💻 Affected Systems
- Arista EOS (Extensible Operating System)
📦 What is this software?
Eos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
⚠️ Risk & Real-World Impact
Worst Case
Full administrative compromise of network devices, allowing attackers to reconfigure networks, intercept traffic, disable security controls, and pivot to other systems.
Likely Case
Local privilege escalation where authenticated users with limited access gain full administrative control over network devices.
If Mitigated
Limited impact if proper access controls and monitoring are in place, with only authorized users having device access.
🎯 Exploit Status
Exploitation requires local access to the device and knowledge of the vulnerability. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EOS 4.24.6M, 4.25.4M, 4.26.2M, 4.27.0F and later
Vendor Advisory: https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
Restart Required: Yes
Instructions:
1. Download appropriate EOS version from Arista support portal. 2. Backup device configuration. 3. Install updated EOS version using 'copy' and 'boot system' commands. 4. Reload device to apply update.
🔧 Temporary Workarounds
Remove nopassword configuration
allRemove 'nopassword' configuration from local user accounts to prevent exploitation
configure terminal
username <username> secret <password>
no username <username> nopassword
Disable vulnerable agents
allDisable OpenConfig and TerminAttr agents if not required
configure terminal
no management api openconfig
no daemon TerminAttr
🧯 If You Can't Patch
- Remove all 'nopassword' configurations from local user accounts
- Implement strict access controls and monitor for unauthorized configuration changes
🔍 How to Verify
Check if Vulnerable:
Check EOS version with 'show version' and verify if local users have nopassword configuration with 'show running-config | include nopassword'Check Version:
show version | grep SoftwareVerify Fix Applied:
Verify EOS version is patched with 'show version' and confirm no nopassword configurations exist📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Configuration changes by unauthorized users
- Authentication bypass attempts
Network Indicators:
- Unexpected configuration changes via management interfaces
- Unauthorized access to device management
SIEM Query:
source="arista-eos" AND (event_type="authentication" AND result="failure") OR (event_type="configuration" AND user!="authorized_user")