1. Home
  2. CVE Database
  3. CVE-2021-28508
MEDIUM · 6.8

CVE-2021-28508

This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is...

Vulnerability Description

This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak IPsec sensitive data in clear text in CVP to other authorized users, which could cause IPsec traffic to be decrypted or modified by other authorized users on the device.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AristaTerminattr< 1.10.11
AristaEos>= 4.23, <= 4.23.11
AristaCcs-722Xpm-48Y4-
AristaCcs-722Xpm-48Zy8-
Arista7050Cx3-32S-
Arista7050Cx3M-32S-
Arista7050Sx3-48C8-
Arista7050Sx3-48Yc-
Arista7050Sx3-48Yc12-
Arista7050Sx3-48Yc8-
Arista7050Sx3-96Yc8-
Arista7050Tx3-48C8-
AristaDcs-7050Cx3-32S-
AristaDcs-7050Cx3-32S-R-
AristaDcs-7050Cx3M-32S-
AristaDcs-7050Sx3-48C8-
AristaDcs-7050Sx3-48Yc12-
AristaDcs-7050Sx3-48Yc8-
AristaDcs-7050Sx3-96Yc8-
Arista7280Cr2Ak-30-

Related Weaknesses (CWE)

CWE-255CWE-319

References

FAQ

What is CVE-2021-28508?

CVE-2021-28508 is a vulnerability with a CVSS score of 6.8 (MEDIUM). This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is...

How severe is CVE-2021-28508?

CVE-2021-28508 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-28508?

Check the references section above for vendor advisories and patch information. Affected products include: Arista Terminattr, Arista Eos, Arista Ccs-722Xpm-48Y4, Arista Ccs-722Xpm-48Zy8, Arista 7050Cx3-32S.