CVE-2021-28506: Arista Eos

Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.

Affected products

• Arista Eos: from 4.24.0, up to and including 4.24.7m; from 4.25.0, up to and including 4.25.3; from 4.25.4, up to and including 4.25.4m; from 4.25.5, up to and including 4.25.5.1m; from 4.26.0, up to and including 4.26.2f

Published 2022-01-14. Last modified 2026-06-17.