EUVD-2026-80251
GHSA-cppj-w9qw-f23c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to EOS gRPC/OpenConfig endpoint
-
DeliverySend OpenConfig request over gRPC
-
ExploitWrong privilege level applied
-
ExecutionWrong AAA method list authorizes action
-
ImpactPerform unauthorized config read/write
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Requires the EOS device to be configured with AAA-based gRPC authorization enabled specifically for OpenConfig - this is the explicit precondition named in the description and is not a default state. The attacker must be an already-authenticated gRPC user (PR is not none). Exploitation is limited to the gRPC OpenConfig path only; the vendor explicitly states non-gRPC OpenConfig requests such as NETCONF are NOT affected. Affected trains are EOS 4.29.0F through the 4.36.0.x series per the EUVD version list; upgrading to the fixed maintenance/feature release removes the condition. |
| Impact | The input CVSS 4.0 vector scores this 9.4 (AV:N/AC:L/PR:H with full VC/VI/VA:H and full subsequent-system SC/SI/SA:H), which is overstated for an authorization-method-list mismatch on a management interface. Two signals soften the raw score: exploitation requires an already-authenticated gRPC user (PR is not none - the vendor set PR:H), and the flaw only manifests when AAA-based gRPC authorization for OpenConfig is explicitly enabled, so this is not a default-config remote-unauth issue. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. The SC/SI/SA:H subsequent-system metrics are questionable - this is an in-process authorization decision on one device with no genuine scope change to a separate security authority, so the 9.4 is inflated versus real-world risk. Realistic priority is moderate: a credentialed insider or an attacker with stolen valid credentials could be evaluated against the wrong AAA method list, potentially gaining more (or fewer) privileges than intended over device configuration. Patch is confirmed available from Arista. Note the 'Information Disclosure' tag conflicts with the actual weakness (CWE-266 incorrect privilege assignment), which is an authorization/integrity problem, not primarily disclosure - verify remediation scope against the Arista advisory rather than the tag. |
| Exploit ScenarioDerived | An authenticated gRPC user on an Arista EOS device configured with AAA-based gRPC authorization for OpenConfig issues OpenConfig requests that get evaluated at the wrong privilege level, causing the device to apply the wrong AAA method list and grant access that should have been denied. No public exploit code is identified; exploitation requires valid credentials and the specific gRPC/OpenConfig AAA authorization configuration. NETCONF and other non-gRPC OpenConfig paths are unaffected. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. A vendor patch is available via Arista Security Advisory 0163, and no public exploit code has been identified at time of analysis; the supplied CVSS 4.0 score of 9.4 should be treated with caution, as it reflects an authorization mismatch on a management interface that requires an already-authenticated user (CVSS vector PR:H) plus a non-default AAA configuration rather than an unauthenticated, scope-changing compromise.
Earlier versions of this analysis (1)
Authenticated users with valid credentials can exploit an incorrect privilege assignment in Arista EOS (CWE-266) when AAA-based gRPC authorization is enabled for OpenConfig, potentially performing OpenConfig operations with elevated privileges. This flaw affects only gRPC OpenConfig requests; NETCONF is explicitly not impacted. Exploitation requires a non-default authorization configuration and valid authentication, and no public exploit code has been identified at time of analysis.
RemediationAI
Patch available per vendor advisory: upgrade to a fixed EOS release from Arista Security Advisory 0163 (https://www.arista.com/en/support/advisories-notices/security-advisory/24719-security-advisory-0163), moving off the affected ceilings listed in the EUVD data and onto the corresponding next feature or maintenance release in each affected train (the version ranges imply fixes beginning with the follow-on releases such as 4.31.0F and 4.32.0F and the subsequent maintenance builds beyond the 4.32.11M/4.33.8M/4.34.7M/4.35.5M/4.36.0.1F ceilings); confirm the exact fixed build against the vendor advisory rather than relying on the inferred range boundaries. If an immediate upgrade is not possible, the most direct compensating control is to disable AAA-based authorization for the gRPC OpenConfig service (or disable the gRPC OpenConfig/management API on the device entirely), which removes the vulnerable authorization path - at the cost of losing programmatic OpenConfig management from that device. Where the API must stay enabled, restrict reachability of the gRPC listener to a dedicated management VRF or trusted jump hosts with strict interface ACLs, and audit which accounts are permitted to open gRPC sessions, since the flaw still requires an authenticated user; note that these measures reduce exposure but do not correct the underlying privilege-assignment error, and NETCONF/CLI-based management remains available as an alternative workflow in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EOS exposes a gRPC-based management API (used by OpenConfig/gNMI-style clients) in addition to NETCONF, CLI and eAPI. When AAA-based authorization is configured for gRPC, incoming RPCs are supposed to be mapped to a per-user privilege level and then evaluated against the correct AAA method list - typically backed by TACACS+, RADIUS or the local user database - which determines whether the caller may read state, modify configuration, or invoke privileged operations. CVE-2026-73461 is a CWE-266 incorrect privilege assignment defect in that mapping: an authenticated gRPC/OpenConfig session can be resolved to the wrong privilege level, so the subsequent authorization check is performed against the wrong method list and can succeed when it should fail. Because the bug lives in the gRPC OpenConfig authorization path specifically, NETCONF and other non-gRPC OpenConfig requests are unaffected, narrowing the exposure to devices that both run the affected EOS trains and have the gRPC OpenConfig + AAA authorization feature enabled. The listed CPE (cpe:2.3:a:arista_networks:eos) is a wildcard product match, so version scoping must come from the ENISA EUVD ranges rather than the CPE string.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable gRPC but gated on a non-default AAA-for-gRPC-OpenConfig config (AC:H) and an authenticated user (PR:L); wrong authorization enables unauthorized config read/write (C:H/I:H), no direct availability loss.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
5DescriptionCVE.org
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.
Executive ViewAI
A privilege-assignment flaw in Arista EOS can let already-authenticated gRPC users of the OpenConfig interface obtain configuration-write access beyond their intended authority on affected network devices. The exposure is limited to devices where AAA-based gRPC authorization has been explicitly configured - a non-default state - and does not extend to NETCONF or other OpenConfig transports, so leadership should treat this as a targeted risk to network infrastructure rather than an enterprise-wide compromise. Because the affected systems are network control-plane devices, unauthorized configuration changes could disrupt connectivity and weaken segmentation for every business service that depends on them.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB