CVE-2021-28511 - CVE House

Back to Database

Status published Medium CVE-2021-28511

This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches t ...

5.8 CVSS

Vulnerability Description

This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet flow. This could allow a host with an IP address in a range that matches the range allowed by a NAT ACL and a range denied by a Security ACL to be forwarded incorrectly as it should have been denied by the Security ACL. This can enable an ACL bypass.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-28511

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.arista.com/en/support/advisories-notices/security-advisory/15862-security-advisory-0078

More from Arista Networks

View All →

Arista EOS Dataplane Denial of Service via Malformed IPsec Packet

A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted

On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.

On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption o

Captive Portal can expose sensitive information

Affected Vendor

Arista Networks

View all reports →

Affected Software

EOS

Vulnerable Versions:

4.24.0, 4.25.0, 4.26.0, 4.27.0

Timeline

Official Publish: August 5th, 2022

Last Modified: June 2nd, 2026

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation