EUVD-2026-80253
GHSA-9qm5-xc58-9xgf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable gNSI service, low complexity, but requires an authenticated low-privileged principal (PR:L); account-property escalation yields high confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
6DescriptionCVE.org
On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.
AnalysisAI
Command injection in the gRPC Network Security Interface (gNSI) Credentialz service of Arista EOS allows an authenticated, low-privileged attacker with access to the gRPC management endpoint to send a crafted request that modifies a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended (CVSS 4.0 base 8.6; assessed CVSS 3.1 8.6, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N). Exposure is conditional: the device must be running an affected EOS maintenance train (4.30.0F through 4.36.0.1F) with gNSI Credentialz configured, a non-default management feature, and the attacker must already hold authenticated access to that endpoint, making this a privilege-escalation-from-foothold rather than an anonymous remote compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the device to be running Arista EOS with the gRPC Network Security Interface (gNSI) Credentialz service configured - this is a non-default management feature and its absence eliminates the vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue but narrower than the raw 8.6 score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: Arista has released fixes for this issue, and the exact patched release for each affected train is documented in Arista Security Advisory 0165 at https://www.arista.com/en/support/advisories-notices/security-advisory/24721-security-advisory-0165 - consult that advisory for the specific fixed version for your 4.30.0F/4.31.0F/4.32.0F/4.33.0F/4.34.0F/4.35.0F/4.36.0F train and upgrade accordingly, since no single fixed version string is provided in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within the next 24 hours, compile an inventory from Arista EOS device management platforms to identify every switch running an affected maintenance train in the range 4.30.0F through 4.36.0.1F, and flag which of those have the gNSI Credentialz service configured (a non-default feature) - those are the only devices at risk; for any exposed device that cannot be patched immediately, restrict access to the gRPC management endpoint to a tightly scoped set of trusted administrative hosts and review recent account-property and privilege changes on those devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today