EUVD-2026-80252
GHSA-hhmm-qmjm-g2hp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated gNMI user (PR:L) over the network (AV:N); AC:H because exploitation needs a specific colliding group-and-user Pathz rule state; read/write of restricted paths gives C:H/I:H, no availability impact (A:N).
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
6DescriptionCVE.org
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.
AnalysisAI
Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a very specific stack of conditions all present simultaneously on Arista EOS: (1) OpenConfig must be configured, (2) a gNMI server must be running on the system, (3) gNSI Pathz must be configured with an active Pathz policy present, and (4) that policy must contain BOTH a group rule AND a user rule referencing the SAME path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but tightly-scoped authorization flaw whose headline CVSS 4.0 score of 7.7 overstates day-to-day risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor patch status for this CVE is not specified in the supplied data, so treat the Arista security advisory 0164 (https://www.arista.com/en/support/advisories-notices/security-advisory/24720-security-advisory-0164) as the source of truth for the fixed EOS releases per affected train and for the associated bug ID - upgrade to the listed maintenance release for your train once identified, rather than assuming any specific fixed version here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arista EOS devices to identify those running a gNMI server with gNSI Pathz authorization under OpenConfig, and flag any whose Pathz policies contain both a group rule and a user rule referencing the same management path. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-842 – Placement of User into Incorrect Group
View allShare
External POC / Exploit Code
Leaving vuln.today