EUVD-2026-80313
GHSA-8wh7-8xq3-25wg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated operator interaction (PR:L/UI:R) causes secrets to be logged to downstream stores (S:C), a confidentiality-only credential exposure (C:L) with no integrity or availability impact.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
5DescriptionCVE.org
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.
Examples of sensitive information include:
- Sensitive CLI commands (e.g., "username bob secret myPass")
- Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key")
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
AnalysisAI
Arista EOS devices that run OpenConfig-based management services (gNMI, gNSI, RESTCONF, NETCONF) can inadvertently write sensitive request and response payloads into logs that persist on the local switch or are forwarded to remote accounting/AAA servers. The leaked material includes plaintext CLI secrets such as 'username bob secret myPass' and sensitive OpenConfig YANG leafs like system/aaa/global/tacacs/config/secret-key, so the exposure is a credential/secret disclosure problem rather than an integrity or availability issue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the EOS device run OpenConfig-related management services - gNMI, gNSI, RESTCONF, or NETCONF - AND that sensitive data (CLI secrets like 'username X secret ...' or sensitive YANG leafs such as system/aaa/global/tacacs/config/secret-key) be transacted through them. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely moderate, disclosure-only issue rather than a critical one, and the signals are internally consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed EOS release identified in Arista Security Advisory 0168 (https://www.arista.com/en/support/advisories-notices/security-advisory/24724-security-advisory-0168); the available data does not enumerate a specific patched version number, so treat that advisory as the authoritative source and confirm the target release with Arista before scheduling the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-256 – Plaintext Storage of a Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today