Arista EOS EUVD-2026-80591

Requires Arista EOS with SNMP configured (specifically SNMPv3 local or remote users defined), so it is gated on SNMP being in use rather than a default state. Exploitation further requires an authenticated user with read access to the device's running configuration OR access to a 'sanitized' configuration export (the key is not stripped during sanitization) - this is the key limiter and also the realistic leak vector via shared configs, backups, or support cases. The exposed value is a one-way hashed, localized SNMPv3 key rather than a plaintext password, so the attacker must leverage SNMPv3 localized-key semantics to authenticate; impact is limited to unauthorized SNMP table reads and forged trap notifications to the NMS (no config write or availability impact).

This is a genuinely low-priority issue despite being remotely scored. The vendor CVSS of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) is well-calibrated: exploitation requires an already-authenticated user (PR:L) with read access to the device's running or sanitized configuration, and the exposed material is a one-way HASHED, localized SNMPv3 key - not a plaintext credential - which is why impact is only C:L/I:L with no availability impact. AC:H reflects that a hashed localized key is not a directly reusable password, though SNMPv3's localized-key model does allow such a key to be replayed for authentication once obtained, which justifies the AV:N and the low integrity impact (fraudulent traps). There is no EPSS score, no POC, and no KEV listing provided; exploitation status is 'no public exploit identified at time of analysis.' Arista found this internally and reports no known malicious exploitation. The most notable nuance is the config-sanitization angle: because the key survives into SANITIZED configs, it can leak through channels operators consider safe to share (TAC cases, backups, config repositories) - that is the realistic exposure path, not a direct network attack. No conflicting signals; CVSS network vector is consistent with SNMPv3 key reuse semantics.

A low-privileged but authenticated operator (or someone who obtains a shared/backed-up 'sanitized' device configuration) reads the one-way hashed, localized SNMPv3 key from the running or sanitized config. They replay that localized key to authenticate to the SNMP engine, performing unauthorized reads of SNMP tables or crafting fraudulent trap notifications to mislead the Network Management System. No public exploit code is known; the high attack complexity reflects the need for config access plus SNMPv3 key manipulation.