CVE-2021-28508

CWE-255CWE-319 — Cleartext Transmission3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.1%
top 64.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Arista EOSArista TerminattrArista Networks Arista EOS+1 more
Timeline
PublishedMay 26
Latest updateMay 27

Description

This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak IPsec sensitive data in clear text in CVP to other authorized users, which could cause IPsec traffic to be decrypted or modified by other authorized users on the device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5arista_networks/arista_terminattrv1.10 — v1.10.10+2
▶NVDarista/terminattr1.11.0 — 1.16.8+2
▶NVDarista/eos4.24 — 4.24.10+4
▶CVEListV5arista_networks/arista_eos4.23 — 4.23.11+4

🔴Vulnerability Details

2
GHSA
GHSA-rg8c-f654-9rhg: This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transp↗2022-05-27
▶
CVEList
TerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP↗2022-05-26
▶