CVE-2026-73447
CriticalCVSS 9.1Summary
A privileged attacker can exploit gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.
Risk Assessment
Risk of full device compromise by a privileged user, potentially leading to network takeover.
Recommendation
Restrict access to gNSI and Bootz services and apply vendor patches.
Other vulnerabilities in Arista EOS
See all- CVE-2026-77190Medium
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The agent is automatically restarted, but repeated attacks can cause continuous restarts and a sustained denial of service.
- CVE-2026-73469Medium
On specific platforms using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.
- CVE-2026-73468Medium
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces. This may result in temporary multicast traffic loss during the affected period.
- CVE-2026-73455High
On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
- CVE-2026-73440Medium
On affected platforms running Arista EOS with SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this information could use it for unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the NMS.
- CVE-2026-73438Medium
On affected platforms running Arista EOS with OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
- CVE-2026-73436Medium
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
- CVE-2026-73435High
On affected platforms running Arista EOS with OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured, can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
- CVE-2026-19640Medium
On affected platforms running Arista EOS, an authenticated user with access to gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.
- CVE-2026-73464High
On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gNMI access to execute arbitrary code with root privileges on the switch.
Original NVD description (English source)
A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.