Description
On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arista Networks | EOS | 4.36.0F – ≤ 4.36.3M, 4.35.0F – ≤ 4.35.7M, 4.34.0F – ≤ 4.34.9M, 4.33.0F – ≤ 4.33.11M, 4.32.0F – < 4.33.0F, 1.0.0 – < 4.32.0F | 4.33.0F |
Advisories 1
- WID-SEC-2026-4509 Arista EOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026