1040 matches found
CVE-2026-77190
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...
CVE-2026-73469
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding uRPF configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the...
CVE-2026-73453
An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...
CVE-2026-73435
On affected platforms running Arista EOS with Open Shortest Path First version 2 OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption...
CVE-2026-73440
On affected platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to thi...
CVE-2026-73438
On affected platforms running Arista EOS with Open Shortest Path First version 3 OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of...
CVE-2026-73436
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly...
CVE-2026-19640
On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...
CVE-2026-77190
CVE-2026-77190 affects Arista EOS where an unauthenticated, network-adjacent attacker can send malformed PIM Sparse Mode messages to a device with both PIM SM and MLAG configured, causing the Pimsm agent to crash. Repeated attacks produce a sustained denial of service through continuous agent res...
EUVD-2026-80388
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...
CVE-2026-77190 Security Advisory 0177
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...
CVE-2026-73440 Security Advisory 0178
On affected platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to thi...
EUVD-2026-80590
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding uRPF configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the...
CVE-2026-73469 Security Advisory 0176
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding uRPF configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the...
EUVD-2026-80591
On affected platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to thi...
CVE-2026-73469
Arista EOS on 7050X4 and 7358X4 series platforms running EOS 4.35.4M or below in the 4.35.x train is affected by a loose Unicast Reverse Path Forwarding (uRPF) bypass (CWE-863). When loose-mode uRPF is configured on an interface, certain traffic that should be dropped based on route verification ...
CVE-2026-73440
Arista EOS devices with SNMPv3 configured may expose user credentials as a one-way hashed key in running and sanitized configurations when using the legacy CLI syntax (without the key format). An authenticated user could leverage this to perform unauthorized SNMP table reads or send fraudulent ...
CVE-2026-73453 Security Advisory 0174
An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...
EUVD-2026-80588
An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...
CVE-2026-73453
CVE-2026-73453 is a critical (CVSS 3.1: 10.0) code injection vulnerability (CWE-94 ) in Arista EOS configured with the P4Runtime service. An unauthenticated attacker who can reach the P4Runtime gRPC endpoint (port 9559) can craft a malicious packet during session initiation to achieve arbitrary c...