Critical · published January 14, 2022
🚨 Local users could waltz right in! With a nopassword configuration, they're gaining unrestricted access through a vulnerability in Arista EOS’s AAA API — a problem that absolutely needs your attention. 🔥 Think of it like leaving your front door wide open with a sign that says 'No password required!' That's exactly the situation here—anyone can stroll in without any checks! If unchecked, this vulnerability allows local users to access the device without any authentication. Imagine the chaos if someone could just change settings or wipe your configurations on a whim—it's a recipe for disaster!
Think of it like leaving your front door wide open with a sign that says 'No password required!' That's exactly the situation here—anyone can stroll in without any checks! This issue arises from the incorrect implementation of Arista EOS's AAA API by the OpenConfig and TerminAttr agents, which fails to enforce proper authentication checks in situations where a nopassword configuration is used.
If unchecked, this vulnerability allows local users to access the device without any authentication. Imagine the chaos if someone could just change settings or wipe your configurations on a whim—it's a recipe for disaster! Immediately review the device configurations for any instances of nopassword settings. Implement proper authentication measures and ensure the AAA API is correctly configured. Lastly, consider upgrading to the latest version of Arista EOS where this vulnerability has been addressed. You've got this! By taking these steps, you'll bolster your defenses and protect your network like a true security hero! 🛡️