Arista EOS CVE-2026-2380

Exploitation requires that the EOS device run OpenConfig-related management services - gNMI, gNSI, RESTCONF, or NETCONF - AND that sensitive data (CLI secrets like 'username X secret ...' or sensitive YANG leafs such as system/aaa/global/tacacs/config/secret-key) be transacted through them. The limiting factor is access: the leaked secrets land in local EOS logs or on remote accounting/AAA servers, so realizing harm requires read access to those logging/accounting sinks. Per the CVSS vector, triggering requires an authenticated actor (PR:L) and a user interaction (UI:P); gRPC-based Streaming Telemetry to CloudVision is explicitly NOT affected. Devices not running OpenConfig services or not transmitting secrets through them are not exposed.

This is a genuinely moderate, disclosure-only issue rather than a critical one, and the signals are internally consistent. The vendor CVSS 4.0 score of 5.1 reflects a credential-leak-to-logs weakness (CWE-256): all vulnerable-system impacts are None (VC:N/VI:N/VA:N) while only the subsequent-system metrics register Low (SC:L/SI:L/SA:L), because the harm is that secrets flow to downstream logging/accounting stores, not to EOS itself. PR:L and UI:P confirm the trigger requires an authenticated operator interaction, which sharply limits an external attacker. No EPSS score, no KEV listing, and no POC were provided; combined with Arista's statement that it was found internally with no observed malicious exploitation, this is 'no public exploit identified at time of analysis.' The main caveat is scope of impact: the true risk is not a remote attacker directly, but that privileged secrets (TACACS keys, user passwords) become readable by anyone with access to local device logs or remote accounting/AAA servers - a lateral/insider exposure that raises the effective blast radius if those log stores are broadly accessible. Prioritize as medium: patch and rotate exposed credentials, but this is not an urgent remote-code or drive-by threat.

An operator issues configuration via gNMI/gNSI/RESTCONF/NETCONF containing secrets (e.g., 'username bob secret myPass' or a TACACS secret-key leaf), and EOS records the full request/response into local logs or forwards it to a remote accounting server. An attacker or insider with read access to those logs or the accounting/AAA server later harvests the plaintext credentials and reuses them for lateral movement. No public POC exists; exploitation depends on access to the logging sinks rather than a network-facing exploit primitive.