Arista EOS (TerminAttr / OpenConfig telemetry transport): The streaming-telemetry agent can leak MACsec keys over the

CVSS 6.1CVE-2021-28509Firmware, BMC & network fabriccurated

Impact

The streaming-telemetry agent can leak MACsec keys over the telemetry transport. Whoever consumes your telemetry stream — often a monitoring platform with far weaker access control than the switches themselves — ends up holding the keys that protect inter-site and inter-pod links. From there an attacker decrypts traffic for every tenant crossing those links.

Who can reach it

An attacker with access to the telemetry stream or to the collector storing it. That is usually a much softer target than the switch.

What to do

EOS/TerminAttr upgrade plus agent restart. Then rotate every MACsec key that could have been exposed — a fabric-wide key rotation is disruptive and is the real cost here, not the upgrade. Treat telemetry collectors as secret-bearing systems going forward.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-28509

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.