Arista EOS EUVD-2026-81000

Requires that VRRP is enabled on the affected Arista EOS switch (the credentials only exist when VRRP with authentication is configured), AND that the attacker holds sufficient privileges to view EOS agent trace logs on the switch OR has access to a system receiving forwarded/syslog output of those logs. Limiting factors: exploitation needs an authenticated, privileged management context (PR:L/PR:H) - it is not remotely reachable by an unauthenticated attacker; impact is confined to disclosure of the peer VRRP shared secret (confidentiality only, no integrity/availability effect). The notable feature that raises the bug above pure log-hygiene is that it does NOT require access to the VRRP network segment.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The vendor CVSS 4.0 score is 2.1 (AV:A/AC:H/PR:L, VC:L only), reflecting a narrow credential-disclosure problem: VRRP peer authentication credentials are written to agent trace logs in cleartext (CWE-532). Exploitation status is no public exploit identified at time of analysis - there is no CISA KEV listing, no POC, and no EPSS score in the provided data, all consistent with a low-interest logging bug. The one nuance worth flagging is the vendor's choice of AV:A (adjacent) with AC:H: the description frames this as reading local agent trace logs on the switch (or logs forwarded to a syslog collector), which reads more like a local/authenticated disclosure than an adjacent-network attack - the AV:A likely models the management-plane access needed, but AV:L is defensible. The real value of the flaw to an attacker is that it leaks peer VRRP credentials WITHOUT the attacker needing access to the network segment where VRRP runs, converting a log-read privilege into a credential the attacker otherwise could not obtain. Impact is limited to confidentiality of a single protocol's shared secret (VC:L, no integrity or availability impact).

An authenticated operator (or an attacker who has compromised a low-privilege management account or a downstream syslog/log-collection server) reads the Arista EOS agent trace logs and finds the peer device's VRRP authentication credentials in cleartext. With those credentials, they could later spoof VRRP advertisements to influence gateway election, despite never having had direct access to the VRRP network segment. No public exploit code is required - the disclosure is passive log-reading.