Arista EOS EUVD-2026-80216

Exploitation requires authenticated, privileged (PR:H) access to the EOS management plane and network reachability to the gNSI (gRPC Network Security Interface) Certz service; the attacker sends a crafted Certz Rotate request, or an equivalent request to the Bootz service. Limiting factors: the gNSI/Bootz gRPC services must be enabled and reachable, and the attacker must already hold a high-privilege management account - this is not exploitable by an unauthenticated or low-privileged user, and no end-user interaction is involved (UI:N). Only the listed EOS trains (4.30.2F through 4.36.0.1F ranges) are affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, score 9.4) describes a network-reachable, low-complexity attack requiring high privileges but no user interaction, with total confidentiality, integrity and availability loss on both the vulnerable and subsequent systems - consistent with root-level device takeover. The critical mitigating signal is PR:H: the attacker must already be an authenticated, privileged user of the gNSI/Bootz management plane, so this is a privilege-escalation/command-execution primitive for an insider or a credentialed/compromised management account rather than an unauthenticated internet-facing RCE. No EPSS score, KEV listing, or public POC was provided, so exploitation appears theoretical at this time; the real-world priority is high for operators exposing gNSI/Bootz broadly or with weak credential segmentation, and lower where management access is tightly restricted. Note the wording tension in the description ('privileged attacker' vs 'authenticated user') - treat PR:H as authoritative and verify the exact privilege tier required against Arista's advisory.

An insider or an attacker who has obtained credentials for a privileged EOS management account connects to the device's gNSI endpoint and issues a crafted Certz Rotate request whose fields embed shell metacharacters. EOS passes the tainted input into an OS command, executing the attacker's payload as root and yielding full control of the switch. No user interaction or additional privilege escalation step is needed once management-plane access is held; the Bootz service offers an equivalent path.