Executive brief
Arista EOS network switches support an optional gRPC Network Packet Sampling Interface (gNPSI) for remote telemetry collection. Under certain configurations, an unauthenticated attacker can send a specially crafted request to this interface to execute arbitrary code with full administrative privileges on the switch, potentially compromising network infrastructure and enabling data exfiltration or lateral movement.
Technical details
CVE-2026-73456 is a code injection vulnerability (CWE-94) in the gNPSI service on Arista EOS-based platforms. The vulnerability occurs when gNPSI is configured with TLS server verification plus metadata authentication, or when mutual TLS is enabled with x509-common-name authentication. An unauthenticated network-based attacker can craft a malicious gNPSI request to achieve arbitrary code execution and gain full administrative control over the affected switch. The vulnerability affects EOS versions 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), and 4.34.2F through 4.34.7M (4.34.x). gNPSI is disabled by default, reducing exposure; mitigation requires configuring mutual TLS with x509-spiffe authentication exclusively.
Affected products
- Arista EOS 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.2F through 4.34.7M (4.34.x)
Timeline
- 2026-09-09: disclosed: Arista Security Advisory 0158 initial release
- 2026-09-16: advisory: CVE-2026-73456 published