CVE-2026-73440
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Summary
On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Arista Networks | EOS | 4.36.0F <= 4.36.1F | affected |
| Arista Networks | EOS | 4.35.0F <= 4.35.5M | affected |
| Arista Networks | EOS | 4.34.0F <= 4.34.7.1M | affected |
| Arista Networks | EOS | 4.33.0F <= 4.33.9M | affected |
| Arista Networks | EOS | 1.0.0 < 4.33.0F | affected |
Weaknesses
- CWE-212: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
Workarounds
No mitigation exists.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.