CVE-2026-73442
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Summary
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Arista Networks | EOS | 4.36.0 <= 4.36.1F | affected |
| Arista Networks | EOS | 4.35.0 <= 4.35.5M | affected |
| Arista Networks | EOS | 4.34.0 <= 4.34.7M | affected |
| Arista Networks | EOS | 4.33.0 <= 4.33.9M | affected |
Weaknesses
- CWE-532: CWE-532 Insertion of Sensitive Information into Log File
Workarounds
If the VRRP feature is not operationally required, disabling it removes the exposure. Otherwise, there is no mitigation or workaround available. Please note that disabling VRRP can lead to network outages if the primary router fails.
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.