Summary
Ein Angreifer kann mehrere Schwachstellen in Arista EOS ausnutzen, um sensible Schlüssel, Passwörter oder TACACS+-Secrets offenzulegen, Sicherheits- und Zugriffskontrollen zu beeinträchtigen, Netzwerk- oder Authentifizierungsdienste zu stören, Benutzerkonten mit erhöhten Berechtigungen auszustatten und im schwerwiegendsten Fall beliebigen Code mit Root-Rechten auf dem betroffenen Switch auszuführen.
Product
Arista Extensible Operating System (EOS) ist ein modulares Linux basiertes Netzwerkbetriebssystem.
Vulnerabilities 8
-
High 8.8
Security Advisory 0166
On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root p…
-
High 8.2
On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou
On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routin…
-
High 8.1
Security Advisory 0165
On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned eleva…
-
Medium 6.3
On affected platforms running Arista EOS, under certain circumstances plaintext private keys
On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilit…
-
Medium 6.3
On affected platforms running Arista EOS, under certain circumstances plaintext user passwords
On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a …
-
Medium 6.3
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
-
Medium 5.3
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitima…
-
Medium 4.8
On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can
On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can ca…
Revision history
-
#1
Initiale Fassung
References
-
Arista Security Advisory vom 2026-09-15
https://www.arista.com/en/support/advisories-notices/security-advisory/24709-security-advisory-0153
-
Arista Security Advisory vom 2026-09-15
https://www.arista.com/en/support/advisories-notices/security-advisory/24707-security-advisory-0151
-
Arista Security Advisory vom 2026-09-15
https://www.arista.com/en/support/advisories-notices/security-advisory/24708-security-advisory-0152
-
Arista Security Advisory vom 2026-09-15
https://www.arista.com/en/support/advisories-notices/security-advisory/24710-security-advisory-0154
-
Arista Security Advisory vom 2026-09-15
https://www.arista.com/en/support/advisories-notices/security-advisory/24710-security-advisory-0154
-
Arista Security Advisory vom 2026-09-15
https://www.arista.com/en/support/advisories-notices/security-advisory/24721-security-advisory-0165
-
Arista Security Advisory vom 2026-09-15
https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166