title: On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.
description: On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.
problem types: CWE-284 Improper Access Control
affected:
{
product: EOS
vendor: Arista Networks
versions:
lessThanOrEqual: 4.26.0, status: affected, version: 4.26.3M, versionType: custom
lessThanOrEqual: 4.27.0, status: affected, version: 4.27.0F, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
solutions: The recommended resolution is to upgrade to a remediated software version at your earliest convenience.
Artista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2021-28505 has been fixed in the following releases:
4.26.4M and later releases in the 4.26.x train
4.27.1F and later releases in the 4.27.x train
workarounds: Replace "vxlan" IP protocol match with match on IP protocol "udp" and Layer 4 destination port for VxLAN encapsulated packets i.e 4789. < br/> If VXLAN L4 destination port number is not the default 4789 then use the configured L4 destination port number.