CVE-2026-73464
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Arista Networks | EOS | 4.29.0F < 4.30.0F | affected |
| Arista Networks | EOS | 4.30.0F < 4.31.0F | affected |
| Arista Networks | EOS | 4.31.0F < 4.32.0F | affected |
| Arista Networks | EOS | 4.32.0F < 4.33.0F | affected |
| Arista Networks | EOS | 4.33.0F <= 4.33.8M | affected |
| Arista Networks | EOS | 4.34.0F <= 4.34.7M | affected |
| Arista Networks | EOS | 4.35.0F <= 4.35.5M | affected |
| Arista Networks | EOS | 4.36.0F <= 4.36.0.1F | affected |
Weaknesses
- CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')
Workarounds
Disable any gNMI transports:
management api gnmi no transport grpc <name>
Disabling all gNMI transports makes gNMI, gNOI, and gNSI services unavailable. If no RESTCONF or NETCONF transports are configured, the OpenConfig/Octa agent will also stop. CloudVision provisioning via TerminAttr is unaffected. All services resume when a gNMI transport is re-enabled.
Note: This mitigation is not applicable to DMF-managed EOS switches. gNMI transports are enabled by default on these platforms and cannot be disabled.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.