Arista EOS EUVD-2026-81008

Requires the gRPC Network Packet Sampling Interface (gNPSI) feature to be enabled on the Arista EOS device - a non-default, opt-in configuration. Exploitation further requires an already-authenticated user (PR:L) who has access to the local or remote accounting logs where the clear-text gNPSI client credentials are recorded. The AT:P / 'under certain circumstances' qualifier means the clear-text logging does not occur universally, limiting exposure to specific conditions. Devices without gNPSI configured are not affected.

This is a moderate-severity information-disclosure issue (vendor CVSS 4.0 6.0), not a high-priority remote-code-execution or unauthenticated-access flaw. The 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) shows the defining constraints: PR:L means the actor must already be an authenticated user, and AT:P plus the description's 'under certain circumstances' indicates the credential exposure only occurs in specific conditions with gNPSI enabled. Impact is confidentiality-only (VC:H, no integrity or availability effect), reflecting credential leakage rather than direct compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation - this is 'no public exploit identified at time of analysis.' The realistic risk is that a lower-privileged authenticated operator who can read local or remote accounting logs harvests gNPSI client credentials for lateral use; this is a real but bounded insider/post-authentication exposure rather than an internet-facing emergency. There is no signal conflict of note, though the exact 'certain circumstances' triggering the clear-text logging are not detailed in the advisory summary and should be confirmed against Arista advisory 24714.

An authenticated user with permission to view local or remote (e.g. TACACS+/RADIUS/syslog) accounting logs on an Arista EOS device that has gNPSI enabled reads those logs and finds gNPSI client credentials recorded in clear text. The attacker reuses the harvested credentials to access the gNPSI telemetry/sampling interface or to move laterally. No public exploit code is required or identified; exploitation is opportunistic log review.