title: In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
description: The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
problem types: CWE-305 Authentication Bypass by Primary Weakness
affected:
{
product: Arista EOS
vendor: Arista Networks
versions:
lessThan: EOS-4.23.10, status: affected, version: EOS-4.23, versionType: custom
lessThan: EOS-4.24.8, status: affected, version: EOS-4.24, versionType: custom
lessThan: EOS-4.25.6, status: affected, version: EOS-4.25, versionType: custom
lessThan: EOS-4.26.3, status: affected, version: EOS-4.26, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
]
solutions: The recommended resolution is to upgrade to a remediated software version at your earliest convenience.
The vulnerability is fixed in the following EOS versions:
4.26.3 and later releases in the 4.26.x train
4.25.6 and later releases in the 4.25.x train
4.24.8 and later releases in the 4.24.x train
4.23.10 and later releases in the 4.24.x train
workarounds: Disallowing user certificate authentication via eAPI can be used to mitigate the vulnerability.
switch(config)#management security
switch(config-mgmt-security)#ssl profile profileEAPI
switch(config-mgmt-sec-ssl-profile-profileEAPI)#no trust certificate user.cert
switch(config-mgmt-sec-ssl-profile-profileEAPI)#exit