EUVD-2026-80319
GHSA-v538-9xwx-vp3j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated existing user (PR:L) exploits a hard-to-win race (AC:H) during a specific config/rotation condition; only integrity of access control is affected (I:H), no confidentiality or availability impact.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
3DescriptionCVE.org
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
AnalysisAI
An authenticated user with gRPC/gNSI access on Arista EOS can retain permissions that a security policy rotation was supposed to revoke, because a race condition in the gNSI Authz service causes the policy rotation to fail silently when multiple gNSI transports are configured on the device. Only non-default deployments with more than one gNSI transport are affected, Bootz is explicitly out of scope, and the flaw does not grant new privileges - it merely preserves access the attacker already legitimately held, so the outcome is a stale authorization state rather than a privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a non-default deployment where MULTIPLE gNSI transports are configured on Arista EOS, AND an Authz policy rotation is performed to change/revoke access, AND the attacker is an already-authenticated gRPC/gNSI user (PR:L) who was targeted by that revocation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely moderate, not critical, issue and the vendor's CVSS 4.0 score of 6.0 is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Arista has published Security Advisory 0169 (https://www.arista.com/en/support/advisories-notices/security-advisory/24725-security-advisory-0169), and the primary fix is to move to the EOS release identified there as containing the gNSI Authz race-condition fix; the provided intelligence does not include an exact fixed version string, so the version must be confirmed against that advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today