CVE-2021-28505

On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.

HIGH

7.5

CVSS Score

Published: April 14, 2022 at 08:05 PM UTC

Updated: June 17, 2026 at 03:46 AM UTC

19 products affected across 2 vendorsEosDcs-7050Cx3M-32SDcs-7050Sx3-96Yc8

Using EOS by Arista Networks?

Get instant alerts when new vulnerabilities affect EOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.9%

Description

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Eos · Arista

95%

4.26 ≤ v < 4.26.4m4.27 ≤ v < 4.27.1f

Affected range stops below 4.26.4m, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.27.1f, so it looks safe — our inference, not a vendor statement

arista-ccs-710p-12 (environment) · arista-ccs-710p-16p (environment) · arista-ccs-720xp-24y6 (environment) · arista-ccs-720xp-24zy4 (environment) · arista-ccs-720xp-48y6 (environment) · arista-ccs-720xp-48zc2 (environment) · arista-ccs-720xp-96zc2 (environment) · arista-ccs-722xpm-48y4 (environment) · arista-ccs-722xpm-48zy8 (environment) · arista-dcs-7010tx-48 (environment) · arista-dcs-7050cx3-32s (environment) · arista-dcs-7050cx3m-32s (environment) · arista-dcs-7050sx3-48c8 (environment) · arista-dcs-7050sx3-48yc12 (environment) · arista-dcs-7050sx3-48yc8 (environment) · arista-dcs-7050sx3-96yc8 (environment) · arista-dcs-7050tx3-48c8 (environment)

Arista EOS · Arista Networks

60%

4.26.3M ≤ v ≤ 4.26.04.27.0F ≤ v ≤ 4.27.04.26.3M 4.27.0F

Ccs-710P-12 · Aristadevice

80%

All versions

Ccs-710P-16P · Aristadevice

80%

All versions

Ccs-720Xp-24Y6 · Aristadevice

80%

All versions