CVE-2021-28504

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as expected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284 CWE-863

Affected software

Vendor	Product	Versions
Arista Networks	EOS	>= 4.26.3F, <= 4.26.0; >= 4.27.0F, <= 4.27.0

References

https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073Mitigation, Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073Mitigation, Vendor Advisory

Timeline

Published: Apr 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-285057.5On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/CVE-2021-285069.1An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could po CVE-2021-285077.1An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and Open CVE-2021-285086.1This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenCon CVE-2021-285096.1This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenCon CVE-2021-285107.5For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value CVE-2021-285116.5This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerabil CVE-2021-285437.5Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This doe CVE-2021-285444.3Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according t CVE-2021-285458.1Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing CVE-2021-285466.5Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing CVE-2021-285477.8Adobe Creative Cloud Desktop Application for macOS version 5.3 (and earlier) is affected by a privilege escalation vulnerability that could