CVE-2021-28506
📋 TL;DR
CVE-2021-28506 is an authentication bypass vulnerability in Arista EOS gNOI APIs that allows unauthorized factory resets of network devices. This affects Arista EOS users with gNOI APIs enabled. Attackers could completely wipe device configurations without valid credentials.
💻 Affected Systems
- Arista EOS
📦 What is this software?
Eos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
Eos by Arista
⚠️ Risk & Real-World Impact
Worst Case
Complete network disruption as devices are factory reset, losing all configurations, routing tables, and security policies, requiring manual restoration from backups.
Likely Case
Targeted attacks against specific devices to cause service disruption or gain initial access to reconfigured devices with default credentials.
If Mitigated
Minimal impact if gNOI APIs are disabled or proper network segmentation isolates management interfaces.
🎯 Exploit Status
Simple API call to gNOI System service's Reset method without authentication. No special tools required beyond network access to gNOI port.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.24.6M, 4.25.4M, 4.26.2M, 4.27.0F and later
Vendor Advisory: https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
Restart Required: Yes
Instructions:
1. Download appropriate fixed EOS version from Arista support portal. 2. Backup current configuration. 3. Install new EOS version using 'copy' and 'boot system' commands. 4. Reload device. 5. Verify version with 'show version'.
🔧 Temporary Workarounds
Disable gNOI APIs
allCompletely disable gNOI service to prevent exploitation
management api gnmi
no shutdown
Restrict gNOI access
allApply ACLs to limit access to gNOI management interfaces
management api gnmi
shutdown
vrf management
ip access-group MGMT-ACL in
🧯 If You Can't Patch
- Isolate management interfaces using VLANs and firewall rules
- Implement strict network segmentation for management traffic
🔍 How to Verify
Check if Vulnerable:
Check EOS version with 'show version' and compare to affected versions. Verify gNOI status with 'show management api gnmi'.Check Version:
show version | include Software image versionVerify Fix Applied:
Confirm version is 4.24.6M, 4.25.4M, 4.26.2M, 4.27.0F or later using 'show version'.📡 Detection & Monitoring
Log Indicators:
- Unexpected factory reset events in system logs
- gNOI API calls from unauthorized sources
- Configuration reloads without administrative action
Network Indicators:
- gRPC/gNOI traffic to port 6030 from unexpected sources
- Factory reset API calls in cleartext gNOI traffic
SIEM Query:
source="arista" AND (event_type="factory_reset" OR message="*Reset*" OR message="*gNOI*System*Reset*")