CVE-2021-28505

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Apr 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-285069.1An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could poCVE-2021-285077.1An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenCVE-2021-285086.1This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConCVE-2021-285096.1This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConCVE-2021-285107.5For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value CVE-2021-285116.5This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerabilCVE-2021-285437.5Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This doeCVE-2021-285444.3Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according tCVE-2021-285458.1Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing CVE-2021-285466.5Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are missing CVE-2021-285477.8Adobe Creative Cloud Desktop Application for macOS version 5.3 (and earlier) is affected by a privilege escalation vulnerability that could CVE-2021-285487.8Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a speciall
CVE-2021-28505: High severity, CVSS 7.5 | Vulnix