EUVD-2026-80253
GHSA-9qm5-xc58-9xgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to gNSI/gRPC endpoint (PR:L)
-
DeliverySend crafted Credentialz request
-
ExploitInject unintended account property modifications
-
ExecutionEscalate target account privileges
-
ImpactGain administrative access to EOS device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the device to be running Arista EOS with the gRPC Network Security Interface (gNSI) Credentialz service configured - this is a non-default management feature and its absence eliminates the vulnerability. The attacker must also hold prior authenticated, low-privileged access to the gNSI/gRPC endpoint (PR:L), so this is a privilege-escalation-from-authenticated-foothold, not an anonymous remote compromise. No user interaction is needed (UI:N). Affected trains span EOS 4.30.0F through 4.36.0.1F (see EUVD version ranges); devices on fixed maintenance releases or without gNSI Credentialz enabled are not exposed. |
| Impact | This is a genuine high-priority issue but narrower than the raw 8.6 score suggests. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) describes a network-reachable, low-complexity privilege-escalation flaw that requires an already-authenticated low-privileged principal (PR:L) - so this is not an unauthenticated takeover. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent: high confidentiality/integrity impact (an attacker gains privileges/access beyond intent) with no availability impact (VA:N), matching a logic/authorization abuse rather than a crash or DoS. The CWE-77/'Command Injection' labeling is the main point of tension - the description reads as improper authorization over account property modification via gNSI Credentialz rather than classic OS/shell command injection, though a crafted-request injection into the credential-management path is plausible; treat the CWE as indicative, not confirmed. Bottom line: a real, patch-worthy escalation flaw gated by prior authenticated access and a non-default configuration, so operationally urgent for Arista shops using gNSI but not a mass-exploitation candidate. |
| Exploit ScenarioDerived | On an Arista EOS device where gNSI Credentialz is configured, an authenticated low-privileged user (with gNMI/gNSI access) sends a specially crafted Credentialz request that manipulates a target account's properties. The account is granted elevated privileges or access the administrator never intended, giving the attacker administrative control of the network device. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Command injection in the gRPC Network Security Interface (gNSI) Credentialz service of Arista EOS allows an authenticated, low-privileged attacker with access to the gRPC management endpoint to send a crafted request that modifies a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended (CVSS 4.0 base 8.6; assessed CVSS 3.1 8.6, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N). Exposure is conditional: the device must be running an affected EOS maintenance train (4.30.0F through 4.36.0.1F) with gNSI Credentialz configured, a non-default management feature, and the attacker must already hold authenticated access to that endpoint, making this a privilege-escalation-from-foothold rather than an anonymous remote compromise. A vendor patch is available per the Arista advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is narrower in practice than the raw score suggests because of the configuration prerequisite.
Earlier versions of this analysis (1)
Authenticated but low-privileged users with access to the gRPC Network Security Interface (gNSI) Credentialz service on Arista EOS can send crafted requests that modify a target account's properties, potentially granting that account elevated privileges or broader access than the administrator intended. The flaw is rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact stemming from the privilege-escalation outcome, with no user interaction required. Exposure is limited to platforms where gNSI Credentialz has been explicitly configured, a non-default management feature; authentication to the gRPC interface is required (PR:L), and no public exploit code had been identified at time of analysis. There is no confirmed active exploitation (no CISA KEV listing) and there is no EPSS signal in the provided data.
RemediationAI
Patch available per vendor advisory: Arista has released fixes for this issue, and the exact patched release for each affected train is documented in Arista Security Advisory 0165 at https://www.arista.com/en/support/advisories-notices/security-advisory/24721-security-advisory-0165 - consult that advisory for the specific fixed version for your 4.30.0F/4.31.0F/4.32.0F/4.33.0F/4.34.0F/4.35.0F/4.36.0F train and upgrade accordingly, since no single fixed version string is provided in the available data. Where an immediate upgrade is not feasible, the most effective compensating control is to disable the gNSI Credentialz service on devices that do not require it; this removes the vulnerable code path entirely, at the cost of losing automated credential provisioning through gNSI. If the service must remain enabled, restrict access to the gRPC/gNSI endpoint with management-plane ACLs, a dedicated management VRF, or source-address filtering so that only trusted management hosts can reach it, and tighten which accounts are permitted to authenticate to gNSI - because exploitation requires prior authenticated low-privileged access (PR:L), reducing that population directly reduces exposure. As a detective control, monitor EOS account and privilege changes and gNSI/gRPC request logs for unexpected modifications to account properties, and validate that no account has been assigned privileges beyond administrative intent. Note that these workarounds reduce but do not eliminate risk for environments that genuinely depend on gNSI Credentialz, so upgrading remains the primary fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Arista EOS is the network operating system that runs on Arista switching platforms, and gNSI (gRPC Network Security Interface) is its gRPC-based management API surface, within which Credentialz provides programmatic credential/account provisioning for the device. The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command, i.e. command injection): input carried in a specially crafted gRPC request is not adequately sanitized before it influences account-modification operations, so a caller can steer the Credentialz workflow into altering attributes of a target account rather than applying only the intended change. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) and the independent CVSS 3.1 assessment (S:U/C:H/I:H/A:N) agree on the core profile: reachable over the network, low attack complexity, no special preconditions beyond configuration state, authenticated low privilege required, no user interaction, high confidentiality and integrity impact but no availability impact. The integrity impact is the operationally significant one because unauthorized changes to account properties can translate directly into privilege escalation on the managed device. Because the vector includes PR:L, the attacker is authenticated; the requirement is prior low-privileged access to the gRPC/gNSI endpoint rather than anonymous reachability. Devices without gNSI Credentialz configured, or those on fixed maintenance releases, are not exposed because the vulnerable code path is never reached.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable gNSI service, low complexity, but requires an authenticated low-privileged principal (PR:L); account-property escalation yields high confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.
Executive ViewAI
Arista EOS switches running affected maintenance-train releases (4.30.0F through 4.36.0.1F) with the optional gRPC Network Security Interface (gNSI) Credentialz service enabled contain a command-injection flaw that allows an attacker already holding authenticated, low-privileged access to that management endpoint to alter account properties and grant themselves broader privileges than administrators intended. The exposure is conditional rather than universal: it requires a non-default management feature to be configured and an existing foothold on the gRPC interface, so leadership should treat this as an insider-or-lateral-movement escalation risk on the network management plane rather than an anonymous internet-facing compromise. Because the affected systems are switches that underpin network segmentation and access control, a successful escalation could enable an attacker to entrench or move laterally across the environment, making inventory and timely patching the priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB