CVE-2026-73461 PUBLISHED

Security Advisory 0163

Assigner: Arista
Reserved: 12.08.2026 Published: 16.09.2026 Updated: 17.09.2026

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	High
User Interaction	None

CVSS 4.0

Product Status

Vendor	Arista Networks
Product	EOS
Versions	Default: unaffected affected from 4.29.0F to 4.30.0F (excl.) affected from 4.30.0F to 4.31.0F (excl.) affected from 4.31.0F to 4.32.0F (excl.) affected from 4.32.0F to 4.32.11M (incl.) affected from 4.33.0F to 4.33.8M (incl.) affected from 4.34.0F to 4.34.7M (incl.) affected from 4.35.0F to 4.35.5M (incl.) affected from 4.36.0F to 4.36.0.1F (incl.)

Affected Configurations

The following conditions must both be met for this vulnerability to be exploitable:

OpenConfig gRPC transport must have an SSL profile configured with request authorization enabled:

Transport: default SSL profile: oc Authorization required: yes

The SSL profile must be configured with a trust certificate.

Workarounds

Ensure that the privilege level 0 AAA authorization method list includes methods beyond 'none' to prevent unintended access escalation:

aaa authorization exec default local group tacacs+ aaa authorization commands 0 default local group tacacs+

To detect potential exploitation, enable AAA accounting and monitor logs for cases where a user's privilege level in gRPC requests does not match their defined privilege level (e.g., a user with privilege 9 appearing as priv-lvl=0 in gRPC requests).

Solutions

The following EOS releases contain the fix for this vulnerability: - 4.33.9M and later releases in the 4.33.x train - 4.34.8M and later releases in the 4.34.x train - 4.35.6M and later releases in the 4.35.x train - 4.36.1F and later releases in the 4.36.x train

No hotfix is available for this vulnerability.

References

Arista Networks Security Advisory 0163

Problem Types

CWE-266 Incorrect Privilege Assignment CWE

Impacts

CAPEC-122 Privilege Abuse