CVE-2026-73439highCWE-842

CVE-2026-73439: falha de alta gravidade em Arista Networks EOS

Security Advisory 0164

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar EOS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.4%
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Arista Networks · EOS
CVEs relacionadas — Arista Networks EOS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-7473MEDIUMArista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding BypassEPSS 1.1%KEVCVE-2024-27890HIGHOn affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).EPSS 4.4%CVE-2021-28506CRITICALAn issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.EPSS 1.4%CVE-2021-28510MEDIUMFor certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.EPSS 1.0%CVE-2021-28505HIGHOn affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.EPSS 0.9%CVE-2023-24511MEDIUMOn affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.EPSS 0.8%