CVE-2026-73457

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158

Configurations

No configuration.

History

16 Sep 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 19:17

Updated : 2026-09-17 19:16

NVD link : CVE-2026-73457

Mitre link : CVE-2026-73457

CVE.ORG link : CVE-2026-73457

JSON object : View

Products Affected

No product.

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-73457", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73457", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T18:32:07.235252Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@arista.com", "affectedData": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "changes": [{"at": "4.36.2F", "status": "unaffected"}], "version": "4.36.0", "versionType": "custom", "lessThanOrEqual": "4.36.1F"}, {"status": "affected", "changes": [{"at": "4.35.6M", "status": "unaffected"}], "version": "4.35.0", "versionType": "custom", "lessThanOrEqual": "4.35.5M"}, {"status": "affected", "changes": [{"at": "4.34.8M", "status": "unaffected"}], "version": "4.34.2F", "versionType": "custom", "lessThanOrEqual": "4.34.7M"}], "platforms": ["710 Series", "720D Series", "720XP/722XPM Series", "750X Series", "7010TX Series", "7020R/R4 Series", "7130 Series running EOS", "7170 Series", "7050X3/X4 Series", "7060X/X2/X4/X5/X6 Series", "7260X/X3 Series", "7280R/R2/R3/R4 Series", "7300X/X3 Series", "7320X Series", "7358X4 Series", "7368X4 Series", "7388X5 Series", "7500R/R2/R3 Series", "7800R3/R4 Series", "7700R4 Series", "AWE 5000 Series", "AWE 7200R Series", "CloudEOS", "cEOS-lab", "vEOS-lab", "CloudVision eXchange", "virtual or physical appliance"], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T19:17:32.453", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158", "source": "psirt@arista.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@arista.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users."}], "lastModified": "2026-09-17T19:16:57.187", "sourceIdentifier": "psirt@arista.com"}