CVE-2021-28504 : On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule whi

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as expected.

Published 2022-04-01 23:15:09

Updated 2022-04-12 13:25:14

Source Arista Networks, Inc.

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Exploit prediction scoring system (EPSS) score for CVE-2021-28504

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-28504

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	Arista Networks, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2021-28504

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: psirt@arista.com (Secondary)

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2021-28504

Arista » EOS
Versions from including (>=) 4.26 and before (<) 4.26.4m
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
Matching versions
When used together with: Arista » Ccs-710p-12 » Version: N/A
When used together with: Arista » Ccs-710p-16p » Version: N/A
When used together with: Arista » Ccs-720xp-24y6 » Version: N/A
When used together with: Arista » Ccs-720xp-24zy4 » Version: N/A
When used together with: Arista » Ccs-720xp-48y6 » Version: N/A
When used together with: Arista » Ccs-720xp-48zc2 » Version: N/A
When used together with: Arista » Ccs-720xp-96zc2 » Version: N/A
When used together with: Arista » Ccs-722xpm-48y4 » Version: N/A
When used together with: Arista » Ccs-722xpm-48zy8 » Version: N/A
When used together with: Arista » Dcs-7010tx-48 » Version: N/A
When used together with: Arista » Dcs-7050cx3-32s » Version: N/A
When used together with: Arista » Dcs-7050cx3m-32s » Version: N/A
When used together with: Arista » Dcs-7050sx3-48c8 » Version: N/A
When used together with: Arista » Dcs-7050sx3-48yc12 » Version: N/A
When used together with: Arista » Dcs-7050sx3-48yc8 » Version: N/A
When used together with: Arista » Dcs-7050sx3-96yc8 » Version: N/A
When used together with: Arista » Dcs-7050tx3-48c8 » Version: N/A
Arista » EOS
Versions from including (>=) 4.27 and before (<) 4.27.1f
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
Matching versions
When used together with: Arista » Ccs-710p-12 » Version: N/A
When used together with: Arista » Ccs-710p-16p » Version: N/A
When used together with: Arista » Ccs-720xp-24y6 » Version: N/A
When used together with: Arista » Ccs-720xp-24zy4 » Version: N/A
When used together with: Arista » Ccs-720xp-48y6 » Version: N/A
When used together with: Arista » Ccs-720xp-48zc2 » Version: N/A
When used together with: Arista » Ccs-720xp-96zc2 » Version: N/A
When used together with: Arista » Ccs-722xpm-48y4 » Version: N/A
When used together with: Arista » Ccs-722xpm-48zy8 » Version: N/A
When used together with: Arista » Dcs-7010tx-48 » Version: N/A
When used together with: Arista » Dcs-7050cx3-32s » Version: N/A
When used together with: Arista » Dcs-7050cx3m-32s » Version: N/A
When used together with: Arista » Dcs-7050sx3-48c8 » Version: N/A
When used together with: Arista » Dcs-7050sx3-48yc12 » Version: N/A
When used together with: Arista » Dcs-7050sx3-48yc8 » Version: N/A
When used together with: Arista » Dcs-7050sx3-96yc8 » Version: N/A
When used together with: Arista » Dcs-7050tx3-48c8 » Version: N/A

Vulnerability Details : CVE-2021-28504

Exploit prediction scoring system (EPSS) score for CVE-2021-28504

CVSS scores for CVE-2021-28504

CWE ids for CVE-2021-28504

References for CVE-2021-28504

Products affected by CVE-2021-28504