An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a fa

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• arista eos4.24.0 and later · up to 4.24.7m inclusive
• arista eos4.25.0 and later · up to 4.25.3 inclusive
• arista eos4.25.4 and later · up to 4.25.4m inclusive
• arista eos4.25.5 and later · up to 4.25.5.1m inclusive
• arista eos4.26.0 and later · up to 4.26.2f inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Arista). Independent of NVD's CPE analysis and usually ahead of it.

• Arista Networks EOS

  • 4.26.2F and later · up to and including 4.26.0affected
  • 4.25.5.1M and later · up to and including 4.25.5affected
  • 4.25.4M and later · up to and including 4.25.4affected
  • 4.25.3 and later · up to and including 4.25.0affected
  • 4.24.7M and later · up to and including 4.24.2Faffected

Other highest-scoring records for the same primary product.

• CVE-2026-7473Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding BypassKEV
  57Plan
• CVE-2015-8236Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote atta
  41Plan
• CVE-2021-28503In Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote at
  39Monitor
• CVE-2023-24509On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO,
  31Monitor
• CVE-2021-28500An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestric
  31Monitor
• CVE-2023-3646On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause syste
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.