CVE-2026-73461 (GCVE-0-2026-73461)
Vulnerability from cvelistv5
Published
2026-09-16 08:01
Modified
2026-09-17 03:56
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
9.4 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE
  • CWE-266 - Incorrect Privilege Assignment
Summary
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.
References
Impacted products
Vendor Product Version
Arista Networks EOS Version: 4.29.0F   < 4.30.0F
Version: 4.30.0F   < 4.31.0F
Version: 4.31.0F   < 4.32.0F
Version: 4.32.0F   <
Version: 4.33.0F   <
Version: 4.34.0F   <
Version: 4.35.0F   <
Version: 4.36.0F   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73461",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T03:56:55.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series (EOS)",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThan": "4.30.0F",
              "status": "affected",
              "version": "4.29.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.31.0F",
              "status": "affected",
              "version": "4.30.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.32.0F",
              "status": "affected",
              "version": "4.31.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.32.11M",
              "status": "affected",
              "version": "4.32.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.33.8M",
              "status": "affected",
              "version": "4.33.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.7M",
              "status": "affected",
              "version": "4.34.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.36.0.1F",
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe following conditions must both be met for this vulnerability to be exploitable:\u003c/p\u003e\u003col\u003e\u003cli\u003eOpenConfig gRPC transport must have an SSL profile configured with request authorization enabled:\u003cpre\u003e\nTransport: default\nSSL profile: oc\nAuthorization required: yes\n\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eThe SSL profile must be configured with a trust certificate.\u003c/li\u003e\u003c/ol\u003e"
            }
          ],
          "value": "The following conditions must both be met for this vulnerability to be exploitable:\n\n1. OpenConfig gRPC transport must have an SSL profile configured with request authorization enabled:\n\n  Transport: default\n  SSL profile: oc\n  Authorization required: yes\n\n2. The SSL profile must be configured with a trust certificate."
        }
      ],
      "datePublic": "2026-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.\u003c/p\u003e"
            }
          ],
          "value": "On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T08:01:20.911Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "name": "Arista Networks Security Advisory 0163",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24719-security-advisory-0163"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "The following EOS releases contain the fix for this vulnerability:\n  - 4.33.9M and later releases in the 4.33.x train\n  - 4.34.8M and later releases in the 4.34.x train\n  - 4.35.6M and later releases in the 4.35.x train\n  - 4.36.1F and later releases in the 4.36.x train\n\nNo hotfix is available for this vulnerability."
        }
      ],
      "source": {
        "advisory": "Security Advisory 0163",
        "defects": [
          "BUG 1602589"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Security Advisory 0163",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eEnsure that the privilege level 0 AAA authorization method list includes methods beyond \u003ccode\u003enone\u003c/code\u003e to prevent unintended access escalation:\u003c/p\u003e\u003cpre\u003e\naaa authorization exec default local group tacacs+\naaa authorization commands 0 default local group tacacs+\n\u003c/pre\u003e\u003cp\u003eTo detect potential exploitation, enable AAA accounting and monitor logs for cases where a user\u0027s privilege level in gRPC requests does not match their defined privilege level (e.g., a user with privilege 9 appearing as priv-lvl=0 in gRPC requests).\u003c/p\u003e"
            }
          ],
          "value": "Ensure that the privilege level 0 AAA authorization method list includes methods beyond \u0027none\u0027 to prevent unintended access escalation:\n\n  aaa authorization exec default local group tacacs+\n  aaa authorization commands 0 default local group tacacs+\n\nTo detect potential exploitation, enable AAA accounting and monitor logs for cases where a user\u0027s privilege level in gRPC requests does not match their defined privilege level (e.g., a user with privilege 9 appearing as priv-lvl=0 in gRPC requests)."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-73461",
    "datePublished": "2026-09-16T08:01:20.911Z",
    "dateReserved": "2026-08-12T16:45:03.511Z",
    "dateUpdated": "2026-09-17T03:56:55.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73461\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T14:52:18.693471Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T14:52:22.433Z\"}}], \"cna\": {\"title\": \"Security Advisory 0163\", \"source\": {\"defects\": [\"BUG 1602589\"], \"advisory\": \"Security Advisory 0163\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 9.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.29.0F\", \"lessThan\": \"4.30.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.30.0F\", \"lessThan\": \"4.31.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.31.0F\", \"lessThan\": \"4.32.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.32.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.32.11M\"}, {\"status\": \"affected\", \"version\": \"4.33.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.33.8M\"}, {\"status\": \"affected\", \"version\": \"4.34.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.34.7M\"}, {\"status\": \"affected\", \"version\": \"4.35.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.35.5M\"}, {\"status\": \"affected\", \"version\": \"4.36.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.36.0.1F\"}], \"platforms\": [\"710 Series\", \"720D Series\", \"720XP/722XPM Series\", \"750X Series\", \"7010TX Series\", \"7020R/R4 Series\", \"7130 Series (EOS)\", \"7170 Series\", \"7050X3/X4 Series\", \"7060X/X2/X4/X5/X6 Series\", \"7260X/X3 Series\", \"7280R/R2/R3/R4 Series\", \"7300X/X3 Series\", \"7320X Series\", \"7358X4 Series\", \"7368X4 Series\", \"7388X5 Series\", \"7500R/R2/R3 Series\", \"7800R3/R4 Series\", \"7700R4 Series\", \"AWE 5000 Series\", \"AWE 7200R Series\", \"CloudEOS\", \"cEOS-lab\", \"vEOS-lab\", \"CloudVision eXchange\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The following EOS releases contain the fix for this vulnerability:\\n  - 4.33.9M and later releases in the 4.33.x train\\n  - 4.34.8M and later releases in the 4.34.x train\\n  - 4.35.6M and later releases in the 4.35.x train\\n  - 4.36.1F and later releases in the 4.36.x train\\n\\nNo hotfix is available for this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-09-09T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24719-security-advisory-0163\", \"name\": \"Arista Networks Security Advisory 0163\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Ensure that the privilege level 0 AAA authorization method list includes methods beyond \u0027none\u0027 to prevent unintended access escalation:\\n\\n  aaa authorization exec default local group tacacs+\\n  aaa authorization commands 0 default local group tacacs+\\n\\nTo detect potential exploitation, enable AAA accounting and monitor logs for cases where a user\u0027s privilege level in gRPC requests does not match their defined privilege level (e.g., a user with privilege 9 appearing as priv-lvl=0 in gRPC requests).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eEnsure that the privilege level 0 AAA authorization method list includes methods beyond \u003ccode\u003enone\u003c/code\u003e to prevent unintended access escalation:\u003c/p\u003e\u003cpre\u003e\\naaa authorization exec default local group tacacs+\\naaa authorization commands 0 default local group tacacs+\\n\u003c/pre\u003e\u003cp\u003eTo detect potential exploitation, enable AAA accounting and monitor logs for cases where a user\u0027s privilege level in gRPC requests does not match their defined privilege level (e.g., a user with privilege 9 appearing as priv-lvl=0 in gRPC requests).\u003c/p\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-266\", \"description\": \"CWE-266 Incorrect Privilege Assignment\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The following conditions must both be met for this vulnerability to be exploitable:\\n\\n1. OpenConfig gRPC transport must have an SSL profile configured with request authorization enabled:\\n\\n  Transport: default\\n  SSL profile: oc\\n  Authorization required: yes\\n\\n2. The SSL profile must be configured with a trust certificate.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe following conditions must both be met for this vulnerability to be exploitable:\u003c/p\u003e\u003col\u003e\u003cli\u003eOpenConfig gRPC transport must have an SSL profile configured with request authorization enabled:\u003cpre\u003e\\nTransport: default\\nSSL profile: oc\\nAuthorization required: yes\\n\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eThe SSL profile must be configured with a trust certificate.\u003c/li\u003e\u003c/ol\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-09-16T08:01:20.911Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73461\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-17T03:56:55.952Z\", \"dateReserved\": \"2026-08-12T16:45:03.511Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-09-16T08:01:20.911Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.