CVE-2021-28511: arista eos

csirt@kutim:~/threat-intel/cve/CVE-2021-28511

CVSS 6.5 · Medium EPSS 0,58%

Kerentanan Improper Access Control pada arista eos. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet flow. This could allow a host with an IP address in a range that matches the range allowed by a NAT ACL and a range denied by a Security ACL to be forwarded incorrectly as it should have been denied by the Security ACL. This can enable an ACL bypass.

Rincian

Terbit di NVD: 5 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 0,58% peluang dieksploitasi; lebih tinggi dari 46,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
arista	eos	Semua versi hingga 4.24.9
arista	eos	Versi 4.25.0 hingga 4.25.8
arista	eos	Versi 4.26.0 hingga 4.26.5
arista	eos	Versi 4.27.0 hingga 4.27.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.arista.com/en/support/advisories-notices/security-advisory/15862-security-advisory-0078 exploit · mitigasi · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.