CVE-2021-28506

highpriority · track · 36OT risk · elevatedEPSS 0.014 · 73 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.42% (73rd) EPSS

CVSS 9.4 · high

Is it mine?

10 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.

cvss

Technical severity, 0–10. One row per scoring source.

9.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.4

v2.09.4highAV:N/AC:L/Au:N/C:N/I:C/A:Cprimary · NVD / NIST USexploitability 10 · impact 9.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hsecondary · psirt@arista.comexploitability 3.9 · impact 5.2

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USprimaryCWE-862USprimaryCWE-285US

affected products (10)

Products and version ranges known to be affected.

Arista Networks EOS≤ 4.25.3 ≤4.25.0enisa_euvdEU
Arista Networks EOS≤ 4.25.4M ≤4.25.4enisa_euvdEU
Arista Networks EOS≤ 4.25.5.1M ≤4.25.5enisa_euvdEU
Arista Networks EOS≤ 4.24.7M ≤4.24.2Fenisa_euvdEU
Arista Networks EOS≤ 4.26.2F ≤4.26.0enisa_euvdEU
arista eos4.24.0 → 4.24.7mnvdUScpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
arista eos4.25.0 → 4.25.3nvdUScpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
arista eos4.25.4 → 4.25.4mnvdUScpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
arista eos4.25.5 → 4.25.5.1mnvdUScpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
arista eos4.26.0 → 4.26.2fnvdUScpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2022-01-14modified 2026-06-17

related (15,825)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-84869US	—OT critical	0.92% (60th)	KEV	2026-09-08
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circum…
CVE-2026-67277US	high8.2OT critical	1.56% (75th)	KEV	2026-09-05
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 U…
CVE-2026-63219US	—OT critical	0.47% (40th)	—	2026-09-03
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is…
CVE-2026-81578US	critical9.8OT critical	83.7% (100th)	KEV	2026-08-28
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting…
CVE-2026-72529US	—OT critical	1.46% (74th)	KEV	2026-08-19
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an ar…

+15820 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan