CVE-2021-28506
CRITICALArista EOS 4.24.0-4.24.7m - Unauthenticated Factory Reset via gNOI API
Title source: llmDescription
An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.
References (1)
Core 1
Core References
Exploit, Mitigation, Patch, Vendor Advisory x_refsource_misc
https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071
Scores
CVSS v3
9.1
EPSS
0.0142
EPSS Percentile
69.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Details
CWE
CWE-285
CWE-306
CWE-862
Status
published
Products (1)
arista/eos
4.24.0 - 4.24.7m
Published
Jan 14, 2022
Tracked Since
Feb 18, 2026