EUVD-2026-81006
GHSA-7g93-8r7h-w6jj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network RCE with full device compromise (C/I/A:H, PR:N), but AC:H reflects the non-default gNPSI-enabled precondition captured as AT:P in the 4.0 vector.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
3DescriptionCVE.org
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
AnalysisAI
Arbitrary code execution in Arista EOS with the gRPC Network Packet Sampling Interface (gNPSI) enabled allows an unauthenticated gNPSI client to craft a malicious request that executes code on the switch, yielding full administrative control of the device. The exploit path is gated by a hard precondition: gNPSI is not enabled by default and the gRPC endpoint must be network-reachable, which the vendor vector captures as AT:P and the advisory describes as 'under certain circumstances'; given that condition, no authentication (PR:N) or user interaction (UI:N) is needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the affected Arista EOS device to have the gRPC Network Packet Sampling Interface (gNPSI) explicitly enabled and network-reachable by the attacker - this feature is not enabled by default, which is the primary limiting factor (reflected as AT:P in the vendor vector and 'under certain circumstances' in the description). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: no vendor-released fixed EOS version is specified in the available data, so patch availability and the exact remediation release must be confirmed directly from Arista Security Advisory 0158 (https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158), which enumerates affected platforms and the corresponding fixed EOS releases - do not assume a version number that is not stated in that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arista EOS switches and identify any that have gNPSI enabled and network-reachable; if gNPSI is not required, disable it, and block the gRPC endpoint from untrusted networks using ACLs or firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today