EUVD-2026-80325
GHSA-9rwj-hhp6-m2cg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to EOS gNMI with limited role
-
ExploitIssue crafted gNMI get/set request
-
ExecutionAuthorization check returns incorrect result
-
ImpactAccess resources beyond assigned permissions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the gNMI (gRPC Network Management Interface) to be enabled/reachable on the EOS device AND a valid authenticated account with at least some gNMI access (PR:L). Exploitation is limited by the need for pre-existing credentials, the high attack complexity (AC:H) indicating dependence on specific role/permission configurations, and the fact that impact is confined to gaining access slightly beyond the user's assigned permissions (no availability impact). Devices without gNMI enabled are not exposed via this vector. |
| Impact | This is a genuinely low-priority issue despite the 'critical'-sounding CWE-863/Authentication Bypass framing. The vendor CVSS of 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) is well-calibrated: exploitation requires an already-authenticated user (PR:L) with existing gNMI access, high attack complexity (AC:H), and yields only limited confidentiality and integrity impact (C:L/I:L) with no availability effect. There is no EPSS score, no CISA KEV listing, and no public POC - Arista states the flaw was found internally and is not aware of any malicious use. SSVC-style signals therefore point to exploitation:none / automatable:no / impact:partial. The bug is an authorization-decision error (a user gets incorrect authz results and may act slightly beyond their assigned permissions), i.e. a bounded privilege-escalation for an insider, not a remote unauthenticated compromise. Note the 'Authentication Bypass' tag conflicts with the actual CWE-863 (Incorrect Authorization): this is an authorization/over-permission flaw, not an authentication bypass, and should not be treated as pre-auth. Net: real but minor, patch on normal maintenance cadence. |
| Exploit ScenarioDerived | An authenticated network operator or restricted-role user who already has gNMI (gRPC Network Management Interface) access to an Arista EOS device issues gNMI operations and, due to the incorrect authorization result, is granted read or configuration access to resources beyond their assigned role. No public exploit code exists and no active exploitation is reported; the high attack complexity suggests success depends on specific role/permission and request conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Incorrect authorization results in Arista EOS gNMI (gRPC Network Management Interface) can allow an already-authenticated management user to reach resources and operations slightly beyond the permissions assigned to their role. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.2), exploitation requires the gNMI interface to be enabled and reachable plus a valid account with at least some gNMI access, and success depends on specific role/permission configurations - a high-complexity, low-impact condition rather than a remote unauthenticated bypass. There is no public exploit identified at time of analysis, no CISA KEV listing, and Arista states the issue was found internally with no known malicious use in customer networks.
RemediationAI
No vendor-released fix version is specified in the data provided, so patch status should be confirmed directly against Arista Security Advisory 0170 (https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170), which is the authoritative source for the corrected EOS releases and upgrade guidance. Until a validated fix is applied, the most effective compensating control is to disable the gNMI service on devices that do not consume it - this fully removes the attack surface but breaks model-driven automation, streaming telemetry collectors and gNMI-based configuration workflows, so it should be scoped to systems without such dependencies. For devices where gNMI must remain available, restrict reachability to a dedicated management VRF or interface and permit only trusted collector/automation source addresses with an ACL or firewall policy; this limits the exposure to attackers who already have a foothold on the management network, at the cost of added operational configuration and a risk of breaking legitimate collectors if the allowlist is incomplete. In addition, review and tighten role assignments for every account with gNMI access, removing permissions not strictly required, since the flaw is configuration-dependent and least-privilege role design reduces both exploitability and blast radius; also monitor gNMI request logs for operations that exceed an account's expected role scope. Note that patching is the only measure that corrects the underlying incorrect-authorization logic - network controls and role hygiene are exposure reducers, not fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is gNMI, the gRPC-based model-driven management and telemetry interface exposed by Arista EOS for configuration, state retrieval and streaming telemetry from automation tooling and collectors. The root cause class is CWE-863 (Incorrect Authorization): the authorization decision applied to gNMI requests does not faithfully map the authenticated user's assigned role and permission set to the requested operation or data, so a request that should be denied can instead be evaluated as permitted. Because the failure is a logic/role-mapping problem rather than a memory-safety or injection flaw, the assessed impact is bounded to low confidentiality and low integrity loss with no availability impact (A:N) and unchanged scope (S:U). The high attack complexity (AC:H) reflects the dependency on particular role/permission configurations - not every deployment with gNMI enabled will be exploitable. The affected-product CPE, cpe:2.3:a:arista_networks:eos:*:*:*:*:*:*:*:*, is a wildcard, meaning the supplied data does not enumerate a discrete version range; scope is limited in practice to EOS devices where gNMI is enabled and reachable and where at least one authenticated account has gNMI access.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated gNMI user (PR:L) over the network (AV:N) with condition-dependent success (AC:H); bounded over-permission yields C:L/I:L and no availability impact.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB