Vulnerability-Lookup

CVE-2026-73447 (GCVE-0-2026-73447)

Vulnerability from cvelistv5 – Published: 2026-09-16 06:04 – Updated: 2026-09-16 17:40

Title

Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

Summary

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 17:40 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Arista mitre root

References

1 reference

URL	Tags
https://www.arista.com/en/support/advisories-noti…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Arista Networks	EOS	Affected: 4.30.2F , < 4.31.0F (custom) Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.0.1F (custom)	guessed

Date Public

2026-09-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T17:40:45.655379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T17:40:57.569Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D/XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series (EOS)",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.30.2F",
                  "status": "affected"
                }
              ],
              "lessThan": "4.31.0F",
              "status": "affected",
              "version": "4.30.2F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.32.0F",
              "status": "affected",
              "version": "4.31.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.33.0F",
              "status": "affected",
              "version": "4.32.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.33.8M",
              "status": "affected",
              "version": "4.33.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.7M",
              "status": "affected",
              "version": "4.34.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.36.0.1F",
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFor the Certz service to be exploitable, gNSI Certz must be enabled on the device. This can be verified with:\u003c/p\u003e\u003cpre\u003e\nswitch#show man api gnsi\nCertz enabled: yes\n\u003c/pre\u003e\u003cp\u003eFor the Bootz service to be exploitable, Bootz must be used for initial provisioning and a CertzProfile containing X509 PEM certificates must be included.\u003c/p\u003e"
            }
          ],
          "value": "For the Certz service to be exploitable, gNSI Certz must be enabled on the device. This can be verified with:\n\n  switch#show man api gnsi\n  Certz enabled: yes\n\nFor the Bootz service to be exploitable, Bootz must be used for initial provisioning and a CertzProfile containing X509 PEM certificates must be included."
        }
      ],
      "datePublic": "2026-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.\u003c/p\u003e"
            }
          ],
          "value": "A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T06:04:25.573Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "name": "Arista Networks Security Advisory 0162",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "The following EOS releases contain the fix for this vulnerability:\n  - 4.33.9M and later releases in the 4.33.x train\n  - 4.34.7.1M and later releases in the 4.34.x train\n  - 4.35.6M and later releases in the 4.35.x train\n  - 4.36.1F and later releases in the 4.36.x train\n\nNo hotfix is available for this vulnerability."
        }
      ],
      "source": {
        "advisory": "Security Advisory 0162",
        "defects": [
          "BUG 1602632"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eFor the Bootz service:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eDo not include X509 PEM certificates in the initial CertzProfile during Bootz provisioning.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eFor the Certz service (choose one):\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eOption 1: Disable gNSI Certz entirely (requires manual SSL profile management going forward):\u003c/p\u003e\u003cpre\u003e\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#no service certz\n\u003c/pre\u003e\u003cp\u003eOption 2: Restrict Certz access using a gNSI Authz policy. Apply an authorization policy that limits the Certz Rotate RPC to only explicitly permitted users:\u003c/p\u003e\u003cpre\u003e\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n\u003c/pre\u003e\u003cp\u003eTo detect potential exploitation, configure auditd to monitor for suspicious child processes spawned by OpenConfig/Octa services:\u003c/p\u003e\u003cpre\u003e\nswitch(config)#monitor security audit\nswitch(config-audit)#rule group process-creation\n-a always,exit -F arch=b64 -S execve -k process-create\n-a always,exit -F arch=b32 -S execve -k process-create\nEOF\nswitch(config-audit)#monitor group process-creation\n\u003c/pre\u003e"
            }
          ],
          "value": "For the Bootz service:\n  - Do not include X509 PEM certificates in the initial CertzProfile during Bootz provisioning.\n\nFor the Certz service (choose one):\n\n  Option 1: Disable gNSI Certz entirely (requires manual SSL profile management going forward):\n    switch(config)#management api gnsi\n    switch(config-mgmt-api-gnsi)#no service certz\n\n  Option 2: Restrict Certz access using a gNSI Authz policy. Apply an authorization policy that limits the Certz Rotate RPC to only explicitly permitted users:\n    switch(config)#management api gnsi\n    switch(config-mgmt-api-gnsi)#service authz\n\nTo detect potential exploitation, configure auditd to monitor for suspicious child processes spawned by OpenConfig/Octa services:\n    switch(config)#monitor security audit\n    switch(config-audit)#rule group process-creation\n    -a always,exit -F arch=b64 -S execve -k process-create\n    -a always,exit -F arch=b32 -S execve -k process-create\n    EOF\n    switch(config-audit)#monitor group process-creation"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-73447",
    "datePublished": "2026-09-16T06:04:25.573Z",
    "dateReserved": "2026-08-12T16:42:47.921Z",
    "dateUpdated": "2026-09-16T17:40:57.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73447",
      "date": "2026-09-16",
      "epss": "0.00756",
      "percentile": "0.53407"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73447\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2026-09-16T07:16:37.087\",\"lastModified\":\"2026-09-16T19:09:28.447\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.\"}],\"affected\":[{\"source\":\"psirt@arista.com\",\"affectedData\":[{\"vendor\":\"Arista Networks\",\"product\":\"EOS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"710 Series\",\"720D/XP/722XPM Series\",\"750X Series\",\"7010TX Series\",\"7020R/R4 Series\",\"7130 Series (EOS)\",\"7170 Series\",\"7050X3/X4 Series\",\"7060X/X2/X4/X5/X6 Series\",\"7260X/X3 Series\",\"7280R/R2/R3/R4 Series\",\"7300X/X3 Series\",\"7320X Series\",\"7358X4 Series\",\"7368X4 Series\",\"7388X5 Series\",\"7500R/R2/R3 Series\",\"7800R3/R4 Series\",\"7700R4 Series\",\"AWE 5000 Series\",\"AWE 7200R Series\",\"CloudEOS\",\"cEOS-lab\",\"vEOS-lab\",\"CloudVision eXchange\"],\"versions\":[{\"version\":\"4.30.2F\",\"lessThan\":\"4.31.0F\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"4.30.2F\",\"status\":\"affected\"}]},{\"version\":\"4.31.0F\",\"lessThan\":\"4.32.0F\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.32.0F\",\"lessThan\":\"4.33.0F\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.33.0F\",\"lessThanOrEqual\":\"4.33.8M\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.34.0F\",\"lessThanOrEqual\":\"4.34.7M\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.35.0F\",\"lessThanOrEqual\":\"4.35.5M\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.36.0F\",\"lessThanOrEqual\":\"4.36.0.1F\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-16T17:40:45.655379Z\",\"id\":\"CVE-2026-73447\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162\",\"source\":\"psirt@arista.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73447\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T17:40:45.655379Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T17:40:50.343Z\"}}], \"cna\": {\"title\": \"Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request\", \"source\": {\"defects\": [\"BUG 1602632\"], \"advisory\": \"Security Advisory 0162\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-88\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-88 OS Command Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 9.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"4.30.2F\", \"status\": \"affected\"}], \"version\": \"4.30.2F\", \"lessThan\": \"4.31.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.31.0F\", \"lessThan\": \"4.32.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.32.0F\", \"lessThan\": \"4.33.0F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.33.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.33.8M\"}, {\"status\": \"affected\", \"version\": \"4.34.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.34.7M\"}, {\"status\": \"affected\", \"version\": \"4.35.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.35.5M\"}, {\"status\": \"affected\", \"version\": \"4.36.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.36.0.1F\"}], \"platforms\": [\"710 Series\", \"720D/XP/722XPM Series\", \"750X Series\", \"7010TX Series\", \"7020R/R4 Series\", \"7130 Series (EOS)\", \"7170 Series\", \"7050X3/X4 Series\", \"7060X/X2/X4/X5/X6 Series\", \"7260X/X3 Series\", \"7280R/R2/R3/R4 Series\", \"7300X/X3 Series\", \"7320X Series\", \"7358X4 Series\", \"7368X4 Series\", \"7388X5 Series\", \"7500R/R2/R3 Series\", \"7800R3/R4 Series\", \"7700R4 Series\", \"AWE 5000 Series\", \"AWE 7200R Series\", \"CloudEOS\", \"cEOS-lab\", \"vEOS-lab\", \"CloudVision eXchange\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The following EOS releases contain the fix for this vulnerability:\\n  - 4.33.9M and later releases in the 4.33.x train\\n  - 4.34.7.1M and later releases in the 4.34.x train\\n  - 4.35.6M and later releases in the 4.35.x train\\n  - 4.36.1F and later releases in the 4.36.x train\\n\\nNo hotfix is available for this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-09-09T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162\", \"name\": \"Arista Networks Security Advisory 0162\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"For the Bootz service:\\n  - Do not include X509 PEM certificates in the initial CertzProfile during Bootz provisioning.\\n\\nFor the Certz service (choose one):\\n\\n  Option 1: Disable gNSI Certz entirely (requires manual SSL profile management going forward):\\n    switch(config)#management api gnsi\\n    switch(config-mgmt-api-gnsi)#no service certz\\n\\n  Option 2: Restrict Certz access using a gNSI Authz policy. Apply an authorization policy that limits the Certz Rotate RPC to only explicitly permitted users:\\n    switch(config)#management api gnsi\\n    switch(config-mgmt-api-gnsi)#service authz\\n\\nTo detect potential exploitation, configure auditd to monitor for suspicious child processes spawned by OpenConfig/Octa services:\\n    switch(config)#monitor security audit\\n    switch(config-audit)#rule group process-creation\\n    -a always,exit -F arch=b64 -S execve -k process-create\\n    -a always,exit -F arch=b32 -S execve -k process-create\\n    EOF\\n    switch(config-audit)#monitor group process-creation\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003e\u003cstrong\u003eFor the Bootz service:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eDo not include X509 PEM certificates in the initial CertzProfile during Bootz provisioning.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eFor the Certz service (choose one):\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eOption 1: Disable gNSI Certz entirely (requires manual SSL profile management going forward):\u003c/p\u003e\u003cpre\u003e\\nswitch(config)#management api gnsi\\nswitch(config-mgmt-api-gnsi)#no service certz\\n\u003c/pre\u003e\u003cp\u003eOption 2: Restrict Certz access using a gNSI Authz policy. Apply an authorization policy that limits the Certz Rotate RPC to only explicitly permitted users:\u003c/p\u003e\u003cpre\u003e\\nswitch(config)#management api gnsi\\nswitch(config-mgmt-api-gnsi)#service authz\\n\u003c/pre\u003e\u003cp\u003eTo detect potential exploitation, configure auditd to monitor for suspicious child processes spawned by OpenConfig/Octa services:\u003c/p\u003e\u003cpre\u003e\\nswitch(config)#monitor security audit\\nswitch(config-audit)#rule group process-creation\\n-a always,exit -F arch=b64 -S execve -k process-create\\n-a always,exit -F arch=b32 -S execve -k process-create\\nEOF\\nswitch(config-audit)#monitor group process-creation\\n\u003c/pre\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eA privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"For the Certz service to be exploitable, gNSI Certz must be enabled on the device. This can be verified with:\\n\\n  switch#show man api gnsi\\n  Certz enabled: yes\\n\\nFor the Bootz service to be exploitable, Bootz must be used for initial provisioning and a CertzProfile containing X509 PEM certificates must be included.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eFor the Certz service to be exploitable, gNSI Certz must be enabled on the device. This can be verified with:\u003c/p\u003e\u003cpre\u003e\\nswitch#show man api gnsi\\nCertz enabled: yes\\n\u003c/pre\u003e\u003cp\u003eFor the Bootz service to be exploitable, Bootz must be used for initial provisioning and a CertzProfile containing X509 PEM certificates must be included.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-09-16T06:04:25.573Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73447\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-16T17:40:57.569Z\", \"dateReserved\": \"2026-08-12T16:42:47.921Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-09-16T06:04:25.573Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73447

Vulnerability from fkie_nvd - Published: 2026-09-16 07:16 - Updated: 2026-09-16 07:16

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@arista.com	https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D/XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series (EOS)",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.30.2F",
                  "status": "affected"
                }
              ],
              "lessThan": "4.31.0F",
              "status": "affected",
              "version": "4.30.2F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.32.0F",
              "status": "affected",
              "version": "4.31.0F",
              "versionType": "custom"
            },
            {
              "lessThan": "4.33.0F",
              "status": "affected",
              "version": "4.32.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.33.8M",
              "status": "affected",
              "version": "4.33.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.7M",
              "status": "affected",
              "version": "4.34.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.36.0.1F",
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@arista.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected."
    }
  ],
  "id": "CVE-2026-73447",
  "lastModified": "2026-09-16T07:16:37.087",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "psirt@arista.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "psirt@arista.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T07:16:37.087",
  "references": [
    {
      "source": "psirt@arista.com",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162"
    }
  ],
  "sourceIdentifier": "psirt@arista.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "psirt@arista.com",
      "type": "Secondary"
    }
  ]
}

GHSA-669F-M4VM-PCM2

Vulnerability from github – Published: 2026-09-16 09:30 – Updated: 2026-09-16 09:30

Details

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

9.4 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-73447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T07:16:37Z",
    "severity": "CRITICAL"
  },
  "details": "A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.",
  "id": "GHSA-669f-m4vm-pcm2",
  "modified": "2026-09-16T09:30:24Z",
  "published": "2026-09-16T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73447"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73447 (GCVE-0-2026-73447)

FKIE_CVE-2026-73447

GHSA-669F-M4VM-PCM2

Tags

Sightings

Nomenclature

Related by attack behaviour