« Volver al listado

CVE-2021-28495

Estado: ModificadaCrítica (9.8)—

In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arista — Metamako Operating System

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-28495",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@arista.com",
      "affectedData": [
        {
          "vendor": "Arista",
          "product": "Metamako Operating System",
          "versions": [
            {
              "status": "affected",
              "version": "MOS-0.13",
              "lessThan": "MOS-0.13*",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "MOS-0.26.7",
              "lessThan": "MOS-0.26.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "MOS-0.32.0",
              "lessThan": "MOS-0.32.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Arista 7130 Systems running MOS"
          ]
        }
      ]
    }
  ],
  "published": "2021-09-09T13:15:09.103",
  "references": [
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/12914-security-advisory-66",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "psirt@arista.com"
    },
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/12914-security-advisory-66",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@arista.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authentication can be bypassed when API access is enabled via the JSON-RPC APIs. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train"
    },
    {
      "lang": "es",
      "value": "En el software MOS (Sistema Operativo Metamako) de Arista, que es compatible con la línea de productos 7130, en determinadas condiciones, la autenticación del usuario puede omitirse cuando se habilita el acceso a la API por medio de las API JSON-RPC. Este problema afecta a: Sistema Operativo Arista Metamako Todas las versiones MOS-0.1x train MOS-0.13 y posteriores en MOS-0.1x train MOS-0.26.6 y posteriores en MOS-0.2x train MOS-0.31.1 y posteriores en MOS-0.3x train"
    }
  ],
  "lastModified": "2026-06-17T03:46:27.790",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arista:metamako_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B89974C-FC70-4BA1-B700-2F0E1A448939",
              "versionEndIncluding": "0.13.0",
              "versionStartIncluding": "0.10.0"
            },
            {
              "criteria": "cpe:2.3:o:arista:metamako_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A83336C6-BEDD-4A4B-8A4D-D230274BC9BC",
              "versionEndIncluding": "0.26.7",
              "versionStartIncluding": "0.20.0"
            },
            {
              "criteria": "cpe:2.3:o:arista:metamako_operating_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "679CE6C2-27E1-4C2C-BF0C-51B158870F6B",
              "versionEndExcluding": "0.32.0",
              "versionStartIncluding": "0.30.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:arista:7130:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4D832798-DA45-4F9E-AA31-5D088253A28A"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@arista.com"
}