CVE-2021-28505: Arista Eos

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

Affected products

• Arista Eos: from 4.26, before 4.26.4m (fixed in 4.26.4m); from 4.27, before 4.27.1f (fixed in 4.27.1f)

Published 2022-04-14. Last modified 2026-06-17.