EUVD-2026-80251
GHSA-cppj-w9qw-f23c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable gRPC but gated on a non-default AAA-for-gRPC-OpenConfig config (AC:H) and an authenticated user (PR:L); wrong authorization enables unauthorized config read/write (C:H/I:H), no direct availability loss.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
7DescriptionCVE.org
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.
AnalysisAI
Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the EOS device to be configured with AAA-based gRPC authorization enabled specifically for OpenConfig - this is the explicit precondition named in the description and is not a default state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 4.0 vector scores this 9.4 (AV:N/AC:L/PR:H with full VC/VI/VA:H and full subsequent-system SC/SI/SA:H), which is overstated for an authorization-method-list mismatch on a management interface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: upgrade to a fixed EOS release from Arista Security Advisory 0163 (https://www.arista.com/en/support/advisories-notices/security-advisory/24719-security-advisory-0163), moving off the affected ceilings listed in the EUVD data and onto the corresponding next feature or maintenance release in each affected train (the version ranges imply fixes beginning with the follow-on releases such as 4.31.0F and 4.32.0F and the subsequent maintenance builds beyond the 4.32.11M/4.33.8M/4.34.7M/4.35.5M/4.36.0.1F ceilings); confirm the exact fixed build against the vendor advisory rather than relying on the inferred range boundaries. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arista EOS devices and identify those running the gRPC OpenConfig service with AAA-based authorization enabled (non-default configuration), and confirm which EOS releases are in scope against Arista Security Advisory 0163; where the affected configuration is not operationally required, disable gRPC/OpenConfig AAA authorization as an immediate risk reduction step. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today