EUVD-2026-80317
GHSA-v35v-w3pj-vq65
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
gNSI Authz Rotate is a network-reachable management RPC needing high-privilege operator access (PR:H), and the sole impact is a corrupted active authorization policy (I:H; C:N/A:N).
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
5DescriptionCVE.org
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
AnalysisAI
An incorrect authorization policy can become active on Arista EOS devices through the gRPC Network Security Interface (gNSI) Authz Rotate RPC, allowing a high-privilege authenticated remote attacker to alter the device's active Authz policy. This integrity-only issue is rated CVSS 4.0 6.9 (Medium; CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) and requires privileged gNSI management credentials; the Bootz service is explicitly unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires access to the gNSI (gRPC Network Security Interface) Authz Rotate RPC on an Arista EOS device and initiating a policy-rotation stream - a management-plane operation that demands high-privilege authenticated access (PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, integrity-only issue, correctly scored as CVSS 4.0 6.9 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; consult Arista security advisory 0167 (https://www.arista.com/en/support/advisories-notices/security-advisory/24723-security-advisory-0167) for patch availability and updated guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today