EUVD-2026-80295
GHSA-hpwc-p8j3-f332
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable gNMI API (AV:N) with low complexity and authenticated low-privilege client (PR:L); root code execution gives full C/I/A within the switch, scope unchanged.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
7DescriptionCVE.org
On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch.
AnalysisAI
Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the gRPC Network Management Interface (gNMI) to be enabled on the Arista EOS switch - a non-default management API that must be explicitly configured - and (2) the attacker to be an authenticated client already possessing valid gNMI access credentials (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority vulnerability that warrants prompt patching. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade EOS to the patched release(s) listed in Arista security advisory SA-0166 (https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166); the advisory is the authoritative source for exact fixed version numbers, which are not enumerated in the available data, so confirm the target release against it before scheduling maintenance windows. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arista EOS devices and determine which have gNMI explicitly enabled; for any switch where gNMI is not essential, disable the gNMI service immediately, and for those where it is required, restrict access to trusted management networks via ACLs or firewall rules and rotate credentials for all gNMI and network-automation accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today