CVE-2021-28503: Arista Eos

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.

Affected products

• Arista Eos: from 4.22, up to and including 4.22.9m; from 4.23, up to and including 4.23.9; from 4.24, up to and including 4.24.7; from 4.25, up to and including 4.25.5; from 4.26, up to and including 4.26.2

Published 2022-02-04. Last modified 2026-06-17.