EUVD-2026-81000
GHSA-2p66-p32j-x932
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reading on-switch agent trace logs requires privileged management access (PR:H, AV:L); impact is limited to disclosure of the VRRP peer secret (C:L), with no integrity or availability effect.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
2DescriptionCVE.org
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.
AnalysisAI
Cleartext disclosure of peer VRRP authentication credentials in Arista EOS log output allows an authenticated, privileged user - or anyone able to read a system receiving forwarded agent trace logs - to recover the shared secret that authenticates VRRP advertisements, without needing any presence on the VRRP network segment itself. The defect applies to EOS platforms configured with authenticated VRRP; exploitation requires high-privilege access to the switch's agent trace logs or to a downstream log collector, and the resulting impact is confidentiality-only (CVSS 4.0 base 2.1; our independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, i.e. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that VRRP is enabled on the affected Arista EOS switch (the credentials only exist when VRRP with authentication is configured), AND that the attacker holds sufficient privileges to view EOS agent trace logs on the switch OR has access to a system receiving forwarded/syslog output of those logs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue, and the signals agree rather than conflict. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data; treat Arista Security Advisory 0157 (https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157) as the authoritative source for the fixed EOS releases and upgrade all VRRP-authenticating switches as soon as a maintenance window permits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today