EUVD-2026-80588
GHSA-383x-9pf8-56g8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach P4Runtime service on EOS switch
-
DeliveryInitiate P4Runtime client session
-
ExploitSend crafted malicious init packet
-
ExecutionTrigger CWE-94 code injection
-
PersistExecute arbitrary code
-
ImpactGain full administrative control of switch
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the affected Arista EOS platform be explicitly configured with P4Runtime enabled - P4Runtime is DISABLED BY DEFAULT, so default installations are not exposed. Given that, an unauthenticated attacker with network access to the P4Runtime service crafts a malicious packet specifically during P4Runtime session initiation to trigger code injection. Limiting factors: the non-default P4Runtime feature must be active; exploitation is timing/condition-dependent (reflected as AT:P in the 4.0 vector, i.e. 'certain conditions'); and only 'affected platforms' running EOS with P4Runtime are in scope. |
| Impact | CVSS 4.0 rates this 9.5 (Critical), consistent with the CWE-94 code-injection outcome: an unauthenticated network attacker gains complete administrative control of the switch (VC/VI/VA:H plus subsequent-system SC/SI/SA:H). However, several signals temper real-world urgency. No EPSS score, no CISA KEV entry, and no public POC are present in the input - exploitation status is 'no public exploit identified at time of analysis.' The flaw was found internally by Arista, which states it is unaware of any malicious exploitation. The single most important limiter is that P4Runtime is disabled by default in EOS, so only the subset of deployments that explicitly enable P4Runtime are exposed; the base CVSS vector cannot express this configuration gate, so the raw 9.5 overstates the exploitable population. The 4.0 vector's AT:P (attack requirements) also signals that success depends on 'certain conditions' rather than being trivially repeatable. Net: a genuinely severe, pre-auth, full-takeover primitive, but real-world priority is bounded by the non-default feature requirement - treat as high priority only for environments known to run P4Runtime. |
| Exploit ScenarioDerived | An attacker with network reach to a switch that has P4Runtime explicitly enabled connects as a P4Runtime client and sends a malicious packet during the initiation of the P4Runtime session, triggering code injection (CWE-94). This yields arbitrary code execution and complete administrative control of the EOS switch. No authentication is required (PR:N), but success is gated on the non-default P4Runtime configuration and the 'certain conditions' implied by AT:P; no public exploit code is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.
Earlier versions of this analysis (1)
Unauthenticated remote code execution in Arista EOS switches that have the P4Runtime feature explicitly enabled lets a remote attacker gain complete administrative control of the device by crafting a malicious packet during the initiation of a P4Runtime session, which carries a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Exposure is sharply limited by configuration: P4Runtime is disabled by default in EOS, so only fleets that deliberately enable it and expose the service to reachable networks are at risk, and the vendor notes the flaw was found internally with no observed malicious exploitation in customer networks and no public exploit identified at time of analysis. The scope-changed (S:C) rating reflects that a successfully compromised switch becomes a pivot point for controlling the surrounding network fabric rather than an isolated host compromise.
RemediationAI
Apply the fixed EOS release identified in Arista Security Advisory 0174 (https://www.arista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174); the exact patched version is listed there and is not reproduced in the available intelligence, so verify the fix train for each affected platform before upgrading. The most effective compensating control is to keep P4Runtime disabled, which is the EOS default - if the feature is not operationally required, confirm it is off (an explicit configuration review is warranted, since enabling it for a past P4 trial may have persisted); the trade-off is the loss of P4 programmability and any controller integrations that depend on it. Where P4Runtime must remain enabled, restrict access to the P4Runtime gRPC service (conventionally TCP 9559) with management-VRF separation and control-plane ACLs that permit only trusted, authenticated controller IPs, keeping in mind that this may break out-of-band controllers and hardware-based P4 pipelines that legitimately connect from other subnets. Additional, lower-cost measures are to segment the switch control plane from user-facing networks, log and alert on unexpected P4Runtime session-initiation attempts or connection attempts from non-controller addresses, and monitor Arista's advisory page for further updates or interim mitigations; no vendor-released patch details were included in the provided data beyond the advisory reference, but the vendor has acknowledged the issue and published guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
P4Runtime is a gRPC-based control-plane specification used to program P4-defined packet-processing pipelines on switches; a controller opens a session with the switch (typically over a TCP gRPC endpoint on the management/control plane, conventionally port 9559) and then installs or modifies table entries, actions, and pipeline configuration. The vulnerability is classified CWE-94 (Improper Control of Generation of Code / Code Injection), which means client-supplied data arriving at the P4Runtime service during session setup is not sufficiently validated before being handled by control-plane software, allowing the injected content to be executed with switch-level privileges rather than merely altering forwarding state. The CPE set (cpe:2.3:a:arista_networks:eos:*:*:*:*:*:*:*:*) indicates the EOS operating system as the affected component, with the practical constraint that only platforms running EOS builds that support P4Runtime and have the feature enabled are in scope - the feature is off by default, so the exposed attack surface is the P4Runtime gRPC listener rather than any default EOS service. The session-initiation trigger explains the AT:P (Attack Requirements: Present) element of the 4.0 vector and the AC:H rating in the 3.1 assessment: code execution is not achievable with an arbitrary request but requires a crafted packet delivered at a precise point in the session handshake.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network pre-auth (AV:N/PR:N); AC:H reflects the crafted-packet timing and 'certain conditions'; S:C for full switch control affecting other systems; C/I/A:H for total takeover.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Executive ViewAI
Arista EOS switches with the optional P4Runtime service enabled are exposed to a critical unauthenticated remote code execution vulnerability that could allow an attacker to gain full administrative control of the device and potentially pivot into connected network segments. Standard EOS deployments are unaffected because P4Runtime is disabled by default, but any organization that has explicitly enabled this service should treat the issue as an urgent, high-impact exposure until the service is disabled or access is tightly restricted. No vendor patch is currently available, and no public exploit code or malicious exploitation has been identified at the time of this analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: disable P4Runtime where not required; if required, restrict access to trusted management networks via ACLs/firewalls, segment the management plane, monitor P4Runtime session initiation for anomalies, and engage Arista support for guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB