Security readout for executives and security teams
Plain-English summary
This flaw can make Arista EOS access-control rules behave broader than intended. In specific ACL configurations, traffic protocol checks may be ignored, allowing network traffic that policy writers expected to block or restrict.
Executive priority
Treat as high priority where Arista devices enforce important segmentation or access policy. Urgency is lower for environments without the affected EOS versions or ACL pattern.
Technical view
On affected Arista EOS platforms, an IPv4 ACL with a VXLAN match rule applied inbound to an L2/L3 port or SVI causes that VXLAN rule and later ACL rules to ignore the specified IP protocol. The CVSS vector indicates network attackability and high integrity impact.
Likely exposure
Exposure is likely limited to Arista EOS 4.26.3M or 4.27.0F systems using affected IPv4 ingress ACL configurations with VXLAN match rules on L2/L3 ports or SVIs.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The risk is policy bypass or unintended traffic handling where impacted ACLs are used for segmentation or enforcement.
Researcher notes
Evidence is narrow but specific: the vulnerable condition depends on ACL content and ingress attachment point. The bundle does not provide fixed versions, affected hardware list, exploit reports, or workaround details beyond vendor advisory reference.
Mitigation direction
- Review Arista advisory 0073 for fixed releases and platform-specific guidance.
- Upgrade affected EOS systems according to Arista guidance.
- Audit and adjust affected ACL configurations until patched.
- Prioritize controls protecting segmentation, tenant boundaries, or sensitive network paths.
Validation and detection
- Inventory Arista EOS devices running 4.26.3M or 4.27.0F.
- Identify IPv4 ACLs applied inbound to L2/L3 ports or SVIs.
- Check whether those ACLs contain VXLAN match rules.
- Review subsequent ACL rules that depend on IP protocol matching.
- Confirm remediation status against Arista advisory 0073.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-28505 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.arista.com/en/support/advisories-notices/security-advisories/15267-security-advisory-0073CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.