{"id":"CVE-2026-73454","published":"2026-09-16T09:17:05.020","lastModified":"2026-09-17T04:18:00.073","description":"On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24721-security-advisory-0165","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows a specially crafted request to modify an account's properties, potentially granting unauthorized elevated privileges. It matters because it can lead to unauthorized access and privilege escalation without proper mitigation.","exploitability":"Exploitation requires gRPC Network Security Interface (gNSI) Credentialz to be configured and a specially crafted request. The attack is moderately difficult to execute, especially if the affected feature is not enabled or properly secured.","blast_radius":"If exploited, the impact could be significant, as it may lead to unauthorized access and privilege escalation, affecting the security and integrity of the system.","remediation":"Disable the gRPC Network Security Interface (gNSI) Credentialz feature or upgrade to the latest version of Arista EOS that addresses this vulnerability, specifically version 4.29.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","priv-escalation","network","grpc","aristaeos"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:45:34.616Z"}}