395489 matches found
CVE-2026-73436
CVE-2026-73436 affects Arista EOS platforms running OSPFv2 with segment routing configured. A specially crafted OSPFv2 packet from an adjacent OSPF neighbor can cause the OSPF process to restart unexpectedly , leading to availability disruption (CVSS 3.1: 6.5 , AV:A/AC:L/PR:N/S:U/C:N/I:N/A:H). Ro...
CVE-2026-73442
CVE-2026-73442 affects Arista EOS with VRRP enabled. Peer device VRRP authentication credentials are logged in cleartext in agent trace logs, allowing an authenticated user with sufficient privileges (or a system receiving forwarded log output) to obtain those credentials without direct access to...
CVE-2026-19655
Arista EOS is vulnerable to a DHCP Relay/Snooping service restart via improper input validation (CWE-20) when DHCP is configured with the information option (Option 82) . An unauthenticated attacker connected to a client-facing VLAN can send a specially crafted packet that causes the DhcpRelay pr...
CVE-2026-73437
Arista EOS with DHCP relay configured is vulnerable to insufficient verification of data authenticity (CWE-345). An unauthenticated attacker with network access can send crafted DHCP reply packets from an unconfigured source IP address, which the relay agent forwards without validation. This allo...
CVE-2026-86106
Arista VeloCloud Edge is affected by a missing authentication vulnerability (CWE-306) on the private HA (High Availability) interconnect. An unauthenticated actor with Layer 2 access to the HA interconnect can trigger sensitive HA peer functions, potentially resulting in elevated command executio...
CVE-2026-73438
CVE-2026-73438 affects Arista EOS where an unauthenticated attacker on the same OSPFv3 broadcast domain can send crafted packets that trigger a Reachable Assertion (CWE-617), causing the Ospf3 agent to crash. This results in the loss of all OSPFv3 adjacencies and potential routing disruption acro...
CVE-2024-35585
Oxford Nanopore MinKNOW , a sequencing software used in nanopore-based genomic analysis, is vulnerable to weak authentication in versions before 24.06 . The application relies on a client's source IP address as its authentication mechanism, meaning an attacker who can spoof or originate traffic f...
CVE-2026-73456
CVE-2026-73456 is a critical code injection vulnerability (CWE-94, CVSSv3.1 10.0 ) in the gNPSI (gRPC Network Packet Sampling Interface) component of Arista EOS platforms. An unauthenticated gNPSI client can craft a malicious request to achieve arbitrary code execution , granting full administrat...
CVE-2026-19640
CVE-2026-19640 affects Arista EOS devices with the gNMI (gRPC Network Management Interface) / OpenConfig component configured with authorized requests. The root cause is incorrect authorization (CWE-863) : an authenticated user may receive incorrect authorization results, potentially allowing acc...
CVE-2026-73446
CVE-2026-73446 affects Arista EOS platforms running IS-IS on a broadcast (LAN) interface. An unauthenticated attacker in the same Layer 2 domain can send a crafted IS-IS Hello PDU that causes the device to tear down an established IS-IS adjacency, resulting in traffic disruption and loss of IP re...
CVE-2026-73454
CVE-2026-73454 is a command injection (CWE-77) vulnerability in Arista EOS affecting the gNSI Credentialz service (part of OpenConfig). A specially crafted request can cause unintended modifications to a target account's properties, potentially granting elevated privileges or access beyond what a...
CVE-2026-73462
CVE-2026-73462 affects Arista EOS running IGMP snooping (enabled by default on all VLANs). A network-adjacent, unauthenticated attacker can send malformed packets to trigger an out-of-bounds read (CWE-125) in the IGMP snooping agent, causing it to terminate and flood multicast traffic to all port...
CVE-2025-23029
CVE-2025-23029 is currently in reserved status with no public technical details about the affected product, root cause, or impact. Monitor for updates as the reserving organization publicizes the vulnerability.
CVE-2026-73458
CVE-2026-73458 affects Arista EOS where Bidirectional Forwarding Detection (BFD) sessions are configured with authentication (Password, Keyed MD5, Meticulous MD5, Keyed SHA1, or Meticulous SHA1). The root cause is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm) . A sp...
CVE-2026-73450
CVE-2026-73450 affects Arista EOS in the MLAG Dual Primary Detection component (CWE-345: Insufficient Verification of Data Authenticity). An unauthenticated attacker with access to the dual-primary detection network segment can send crafted UDP heartbeat packets that, if present when the MLAG pri...
CVE-2024-26225
CVE-2024-26225 is currently reserved with no public technical details available in the provided documents. Monitor for future updates when the candidate is officially publicized with full disclosure.
CVE-2026-84915
This CVE is currently reserved as a placeholder with no public technical details available regarding the affected product, root cause, or impact. Monitor for updates when the candidate is formally publicized.
CVE-2026-84910
CVE-2026-84910 is currently in reserved status with no public technical details available. The vulnerability type, affected products, and impact are not yet disclosed. Monitor for future updates when the assignee publishes the full description.
CVE-2026-84919
This CVE entry is currently reserved and no technical details are publicly available in the provided documents. Affected products, root cause, and impact remain unspecified. Monitor for updates once the candidate is publicized.
CVE-2026-73465
CVE-2026-73465 is a CWE-532 (Insertion of Sensitive Information into Log File) vulnerability in Arista EOS , where plaintext private keys may be written to log files under specific conditions. Exploitation requires authenticated local administrative access and MgmtSecuritySslCertKey trace levels ...
CVE-2026-73466
CVE-2026-73466 affects Arista EOS , where plaintext user passwords may be written to log files when PyServer trace level 4 is explicitly enabled on the Aaa agent (CWE-532: Insertion of Sensitive Information into Log File). Exploitation requires authenticated local administrative access plus non-s...
CVE-2026-73463
CVE-2026-73463 is a race condition in the gNSI Authz service on Arista EOS that occurs when multiple gNSI transports are configured. A policy rotation may fail silently, allowing an authenticated user whose access was revoked by the new policy to retain unauthorized access to gRPC interfaces . Th...
CVE-2025-46418
Westermo WeOS 5 (version 5.24 and later), an operating system deployed in industrial settings, is vulnerable to OS command injection through unsafe handling of media definitions . An attacker with administrative privileges can execute commands beyond their typical access rights, potentially compr...
CVE-2026-75943
CVE-2026-75943 is an incomplete cleanup (CWE-459) vulnerability in Arista EOS affecting deployments with 802.1X authentication and ACL-based authorization enabled. When an authenticated supplicant is removed via the clear dot1x host all CLI command or due to a supplicant timeout, a brief window o...
CVE-2026-19641
CVE-2026-19641 affects Arista EOS password authentication. Due to improper encoding or escaping (CWE-116) , a specially crafted password can create orphan authentication sessions that accumulate in EOS's internal session pool. Repeated exploitation exhausts this pool, preventing legitimate users ...
CVE-2026-81163
CVE-2026-81163 is a reserved candidate with no public technical details yet. The affected product, vulnerability type, and impact remain undisclosed. Action: monitor for updates once the reserving organization publicizes the entry.
CVE-2026-86108
CVE-2026-86108 is an OS Command Injection (CWE-78) in Arista VeloCloud Edge (formerly VeloCloud Edge by Broadcom). Insufficient validation of inputs supplied through management and configuration workflows may allow an authorized request or configuration value to be interpreted as an operating-sys...
CVE-2026-2380
CVE-2026-2380 affects Arista EOS devices running OpenConfig-related services (gNMI , gNSI , RESTCONF , or NETCONF ). Sensitive requests and responses—such as CLI commands containing passwords or OpenConfig YANG leafs with secret keys—may be unintentionally logged by the OpenConfig/Octa agent to l...
CVE-2026-73468
Arista EOS running PIM Sparse Mode is vulnerable to a specially crafted packet that causes premature expiry of multicast forwarding state on affected interfaces, leading to temporary loss of multicast traffic forwarding . The root cause is classified as CWE-670 (Always-Incorrect Control Flow Impl...
CVE-2026-73459
CVE-2026-73459 affects Arista EOS with IS-IS configured. An unauthenticated attacker in the same Layer 2 domain can inject a specially crafted IS-IS LSP PDU that causes a legitimate LSP to be purged from the link-state database due to improper validation of the integrity check value (CWE-354), po...
CVE-2026-75944
CVE-2026-75944 is a race condition in Arista EOS during 802.1X supplicant re-authentication that may leave a stale ACL entry in the system. If the AclAgent process subsequently restarts, this stale entry can be applied to new supplicants, resulting in incorrect access control enforcement . The vu...
CVE-2026-84923
CVE-2026-84923 has been reserved but no technical details are yet publicly available in the provided documents. Affected products, root cause, and impact remain unknown. Monitor for updates as the reserving organization publishes details.
CVE-2026-84913
This CVE is currently reserved with no public technical details available in the provided documents. The vulnerability description, affected products, and impact remain unknown. Monitor for updates as details are expected once the vendor publicizes the issue.
CVE-2026-84917
CVE-2026-84917 is currently in a reserved state. No technical details about affected products, root cause, or impact are publicly available in the provided documents. Monitor for updates once the candidate is publicized.
CVE-2026-84911
CVE-2026-84911 has been reserved by an organization or individual and no technical details are yet publicly available. Monitor for updates when the candidate is publicized.
CVE-2026-73453
CVE-2026-73453 is a critical code injection vulnerability (CWE-94) in Arista EOS P4Runtime service, scored CVSS 3.1: 10.0 . An unauthenticated P4Runtime client can achieve arbitrary code execution and complete administrative control over an affected switch by crafting a malicious packet during se...
CVE-2026-73439
CVE-2026-73439 is a High severity (CVSS 7.5) vulnerability in Arista EOS affecting the OpenConfig gNMI component. When gNSI Pathz is configured with a policy containing both a group rule and a user rule for the same path, gNMI may fail to correctly enforce those rules, allowing an authenticated u...
CVE-2026-77522
CVE-2026-77522 is currently a reserved candidate with no public technical details yet. Affected product, root cause, and impact remain unknown. Monitor for updates when the reserving organization publicizes the vulnerability.
CVE-2026-73464
Arista EOS running with gNMI (gRPC Network Management Interface) enabled is vulnerable to arbitrary code execution with root privileges (CWE-94 Code Injection) by a specially crafted request from an authenticated gNMI client. The CVSSv3.1 score is 8.8 (High) . The issue was discovered internally ...
CVE-2026-86109
VeloCloud Edge (formerly VeloCloud Edge by Broadcom) is affected by an improper verification of cryptographic signature (CWE-347) in its software update workflow. The workflow does not restrict the digest algorithm used for artifact verification, allowing an attacker with sufficient privileges to...
CVE-2026-73460
CVE-2026-73460 affects Arista EOS devices running IS-IS graceful restart . An unauthenticated attacker in the same Layer 2 domain can inject a malformed IS-IS LSP PDU to terminate the graceful restart procedure prematurely, resulting in traffic loss following a restart event. The weakness is clas...
CVE-2026-73445
CVE-2026-73445 affects Arista EOS (4.31.x–4.36.x trains). The root cause is improper input validation (CWE-20) in the gNSI Authz Rotate RPC : when a Rotate request contains multiple uploadRequest entries, a previously uploaded but not finalized Authz policy may become active instead of the intend...
CVE-2026-73451
Arista EOS on dual switch card platforms (755 Series and 758 Series ) is affected by an incorrect initialization of resource (CWE-1419) in ingress Security ACLs on SVIs configured in shared mode . Restarting the secondary switchcard forwarding agent or inserting a secondary switchcard can cause t...
CVE-2026-73440
CVE-2026-73440 is a medium-severity vulnerability (CVSS 3.1: 4.2) in Arista EOS where SNMPv3 user credentials may be exposed as one-way hashed, localized key values within the device's running and sanitized configurations. An authenticated user who accesses this information could perform unauthor...
CVE-2026-77191
CVE-2026-77191 affects Arista EOS deployments with 802.1X configured in authenticator mode and per-supplicant ACL-based authorization. An authenticated supplicant on an adjacent network segment may send traffic without the intended ACL applied during a brief window (milliseconds to seconds) betwe...
CVE-2026-73443
CVE-2026-73443 affects Arista EOS running VRRPv2 with IP-AH authentication enabled. An unauthenticated attacker on the same Layer 2 segment can capture and replay a legitimate VRRP advertisement indefinitely (CWE-294), advertising stale state that prevents a backup router from assuming the virtua...
CVE-2026-86107
CVE-2026-86107 is an out-of-bounds write (CWE-787) in the VCMP tunnel protocol on Arista VeloCloud Edge and VeloCloud Gateway (formerly VeloCloud by Broadcom). The flaw occurs when processing tunneled IP fragments between authenticated overlay neighbors. A successful exploit causes the affected p...
CVE-2026-73449
CVE-2026-73449 affects Arista EOS when both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization are configured. A low-privileged attacker on an adjacent segment who induces a RADIUS packet through the proxy client can prevent Change-of-Authorization (...
CVE-2026-73435
CVE-2026-73435 affects Arista EOS where OSPFv2 with cryptographic authentication (MD5 or SHA) is configured on a broadcast interface with at least two neighbors. An unauthenticated attacker on the same broadcast segment can send a specially crafted OSPFv2 packet, causing adjacency flapping and pa...