CVE-2026-73464: Improper Control of Generation of Code

On affected platforms running Arista EOS with gRPC Network Management Interface gNMI enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface gNMI access to execute arbitrary code with root privileges on the switch...

Security Advisory 0143

Security Advisory 0143 . CSAF PDF Date: June 23, 2026 Revision | Date | Changes ---|---|--- 1.0 | Jun 23, 2026 | Initial release 1.1 | Jul 24, 2026 | Clarification of certain details 1.2 | August 10, 2026 | Added CSAF JSON file for download Description All of the CVEs covered in this advisory app...

CVE-2024-27892

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch...

CVE-2026-8271 D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection

A vulnerability was identified in D-Link DNS-320 2.06B01. The impacted element is the function cgispeed/cgidhcpdlease/cgiddns/cgisetip/cgiupnpdel/cgidhcpd/cgiupnpadd/cgiupnpedit of the file /cgi-bin/networkmgr.cgi. The manipulation leads to os command injection. The attack is possible to be carri...

Ricoh Web Image Monitor 输入验证错误漏洞

Ricoh Web Image Monitor is a network management interface for multifunctional printing devices from the Japanese company Ricoh. It provides remote monitoring and configuration capabilities. Ricoh Web Image Monitor has a vulnerability related to input validation, which stems from open redirection...

CVE-2025-56015

In GenieACS v1.2.13 , an unauthenticated access vulnerability in the NBI API endpoint (Port 7557) allows attackers to retrieve sensitive data, including password hashes and salts. Furthermore, a critical JS Sandbox Escape via the declare.constructor.constructor prototype chain enables Remote Code...

CVE-2017-20238

Hirschmann Industrial HiVision (versions 06.0.00 and 07.0.00 before 06.0.06 and 07.0.01) contains an improper authorization vulnerability that lets read-only users gain write access to managed devices by bypassing access controls. The issue affects multiple interfaces, including the web UI and SN...

CVE-2026-5215

A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element is the function...

CVE-2025-37155

CVE-2025-37155 describes an improper access-control flaw in the SSH restricted shell interface of network management services. The vulnerability could allow an attacker with authenticated read-only privileges to escalate to administrator access on affected systems. Documented in multiple sources,...

CVE-2025-20214

A vulnerability in the Network Configuration Access Control Module NACM of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability exists because a subtle change in inner API call behavior caus...

CVE-2025-20214

CVE-2025-20214 affects Cisco IOS XE Software NACM. A subtle change in inner API call behavior can cause NACM-filtered results to be returned, enabling an authenticated remote attacker to read configuration or operational data via NETCONF, RESTCONF, or gNMI. The attack requires the attacker to hol...

CVE-2023-24512

On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent referred to as the TerminAttr agent is enabl...

Arista Networks Arista EOS 安全漏洞

Arista Networks Arista EOS is a scalable operating system for data centers and cloud network centers from Arista Networks, Inc. Arista EOS builds cloud architectures that scale to hundreds of thousands of compute and storage nodes with management and provisioning capabilities for large-scale jobs...

The vulnerability of the Elastic Services Controller’s network management mechanism, related to errors in API request validation, allows a perpetrator to bypass authentication procedures and execute arbitrary code.

The vulnerability of the Elastic Services Controller’s network management interface is related to errors in checking API requests. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures and execute arbitrary code by sending a specially crafted request to the RE...