CVE-2026-19641

Summary

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Affected Software

Weaknesses

• CWE-116: CWE-116 Improper Encoding or Escaping

Workarounds

The workaround is to disable password based authentication services, such as Telnet and SSH.

NOTE: This workaround only works for local authentication. There is no workaround if the device requires password authentication via a remote method, e.g. Terminal Access Controller Access-Control System Plus (TACACS+), Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP).

Use the following command to disable Telnet.

switch(config)#management telnet switch(config-mgmt-telnet)#shutdown

On the client host, use the following command to generate SSH keys.

client# ssh-keygen -t ecdsa -b 521 -f testkey

Copy the SSH public key to the device and add it to the local user.

switch(config)#copy scp:<local_path_with_keys>/testkey.pub flash: switch(config)#username <user> sshkey file flash:testkey.pub

Add public-key as the first protocol for SSH authentication, keep keyboard-interactive as the second protocol for now.

switch(config)#management ssh switch(config)#authentication protocol public-key keyboard-interactive

Once you have verified that the user can know login without a password from the client host, remove keyboard-interactive from SSH authentication protocol configuration.

switch(config)#management ssh switch(config)#authentication protocol public-key

WARNING: Incorrect configuration may block logins. Make sure public-key authentication works before removing keyboard-interactive from the configuration.

Instead of public key, certificate-based authentication can also be used as a workaround for local users.

Please find more details about how to configure certificate-based authentication in the SSH Certificates User Guide https://www.arista.com/en/support/toi/eos-4-22-1f/14286-ssh-certificates .

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24708-security-advisory-0152

• ←Previous
• Next→