CVE-2026-73440

Executive Summary

CVE-2026-73440 is an information-disclosure vulnerability in Arista EOS in which SNMPv3 user credentials are exposed as one-way hashed, localized key values inside the device's running and sanitized configuration output. It affects Arista EOS platforms running SNMPv3, and any authenticated user (or anyone able to obtain a sanitized/technical-support configuration export) who reads these hashes gains the material required to perform unauthorized SNMP read operations or to inject fraudulent trap notifications into the Network Management System (NMS). Arista discovered the issue internally and reports no known malicious exploitation in customer environments, but the credentials exposure is persistent and identity-borne, making it a viable stepping stone for network-infrastructure reconnaissance and monitoring-plane abuse.

Technical Analysis

CWE-212 is "Improper Removal of Sensitive Information Before Storage or Transfer." The NVD description states that on affected platforms running Arista EOS with SNMPv3 configured, "SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations." Two properties matter here:

1. The exposure is in configuration output, not memory. The sensitive value persists in running-config as well as in "sanitized" configurations — i.e., the outputs that are normally scrubbed for support cases, audits, and off-box backups. This is the crux of the CWE-212 classification: a sanitization step is failing to strip SNMPv3 keying material.
2. The value is a localized, hashed key, not a plaintext community string. SNMPv3 derives authentication and privacy keys from a passphrase using a key-localization procedure (RFC 3414 key localization with a device-specific engine ID). Consequently, the exposed value is not trivially a cleartext password. However, because the hash is localized to the device's SNMP engine, it is directly reusable against that same device: the engine-localized key is exactly the form SNMPv3 requires on the wire for USM authentication. This is what elevates the finding above a cosmetic information leak — the artifact in configuration is the operational credential for that device's SNMPv3 USM processing.

Attack surface: the management plane of the switch/router platform. Reachability follows the configuration's own exposure model — running-config is exposed to anyone with authenticated read access (CLI, TACACS/RADIUS-backed accounts, or a management API that returns configuration state), while "sanitized configurations" are typically distributed beyond the device to support tooling, backup repositories, and ticketing systems. The vulnerability class therefore encompasses both on-device credential access by an authenticated low-privilege user and off-device credential access by anyone who later obtains a sanitized config export.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N (4.2 Medium) is consistent with this reading:

• AV:N / PR:L / UI:N — remotely reachable, requires some prior authentication, no user interaction.
• AC:H — exploitation is not guaranteed by a single request; it depends on the attacker obtaining and being able to use the localized keying material (and, in practice, on the specific SNMPv3 user levels configured).
• C:L / I:L — limited confidentiality impact (SNMP table reads, which may reveal topology, interface, and host data) and limited integrity impact (spoofed traps can influence the NMS, but not directly mutate device configuration).
• A:N — the device itself remains available; this is not a denial-of-service issue.

Affected-version granularity is not published in the intelligence provided. Arista EOS version boundaries, the specific configuration forms that trigger exposure, and whether all SNMPv3 auth/priv levels are equally affected are not specified. Treat any EOS release running SNMPv3 as potentially in scope until the vendor's advisory identifies fixed trains.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code exists for this CVE. The attack chain below is described at the vulnerability-class level, strictly derived from the NVD description.

1. Reconnaissance / target identification. An adversary identifies network infrastructure likely running Arista EOS with SNMPv3 configured — via internet- or management-network-reachable device banners, management interfaces, or by being an insider/customer with access to a sanitized configuration artifact (support bundle, audit export, configuration backup repository). Because "sanitized" configurations are the exact output intended to be safe to share, this reconnaissance step can occur entirely off-device, in a file share or ticketing system, without ever touching the device.

2. Triggering the flaw class. The flaw is a sanitization/redaction failure (CWE-212): the localized SNMPv3 keying material, which should be removed or masked before configuration output is generated, is instead emitted into the running configuration and into sanitized configurations. There is no memory-corruption or injection trigger — exposure occurs as a byproduct of normal configuration-read operations by an authenticated user, or of routine configuration export. An attacker holding an authenticated but low-privilege account simply reads configuration state; an attacker holding a stale support bundle simply reads the file.

3. Payload / execution. The attacker extracts the one-way hashed, localized SNMPv3 user key value. Because the value is the device-localized form, it can be supplied to an SNMPv3 USM transaction against the same device without inverting the hash. Two outcomes are explicitly described by the vendor: (a) unauthorized read operations against SNMP tables (MIB polling — interface counters, ARP/neighbor tables, routing and topology data), and (b) sending fraudulent SNMP trap notifications to the NMS. No fabricated request syntax or parameter names are asserted here; the mechanism is the documented SNMPv3 USM credential reuse.

4. Post-exploitation impact. The attacker obtains a monitoring-plane foothold that is quiet and plausible: polling looks like ordinary NMS traffic, and forged traps are, by design, trusted by the NMS. The result is network-topology and asset discovery (C:L), plus the ability to poison the monitoring/alerting layer with false events or suppress-confidence alerts (I:L). The credential is a keyed, device-localized artifact — revocation requires re-keying the SNMPv3 user on the device, not merely rotating a console password.

Impact Assessment

Business impact concentrates in two areas: information disclosure and monitoring integrity.

• Confidentiality (Low, C:L): SNMP MIB reads can enumerate interfaces, addressing, neighbor relationships, and device health. Aggregated across many devices, this materially improves an attacker's network map and supports lateral-movement planning. Individual reads are low-value; fleet-wide reads are not.
• Integrity (Low, I:L): Fraudulent SNMP traps injected into the NMS can generate false alarms, mask real events, or misdirect SOC attention. They cannot directly reconfigure the device (A:N, S:U), but they degrade trust in the monitoring pipeline — a prerequisite for later, higher-impact operations.
• Availability (None, A:N): No denial-of-service component.
• Exploitability context: EPSS 0.00255 (17.3rd percentile) indicates low predicted near-term exploitation activity, consistent with the vendor's statement that no malicious exploitation has been observed. CISA KEV listing: none.

Blast radius: every affected EOS device where SNMPv3 users are configured, and every downstream consumer of sanitized configuration exports — including support vendors, backup systems, configuration-management repositories, and third-party audit tooling. The sanitized-config angle means the exposure surface extends beyond the device's own access controls into any system that stores or transmits configuration text. Privilege required is Low (PR:L), and the primary attack vector is Network (AV:N), so an authenticated, unprivileged management user is a sufficient starting point.

Prioritize internet-exposed management planes and any environment where config exports are broadly accessible; de-prioritize isolated, single-admin, SNMPv3-free deployments.

Detection Guidance

Sigma Rule

title: Arista EOS SNMPv3 Localized Key Exposure in Configuration Output
id: 8f3c1b2e-7344-4c0a-9d51-2026073440aa
status: experimental
description: Detects read/export of running or sanitized configuration on Arista EOS
  following or preceding SNMPv3 credential exposure (CVE-2026-73440). Correlates
  config retrieval events with SNMPv3 keying material appearing in outputs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73440
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.credential-access
  - attack.t1552
logsource:
  product: arista
  service: eos
detection:
  selection_cmd:
    CommandLine|contains:
      - 'show running-config'
      - 'show running-config sanitized'
      - 'show running-config all'
      - 'copy running-config'
  selection_context:
    - 'snmpv3'
    - 'localized'
  condition: selection_cmd
falsepositives:
  - Routine backup jobs and configuration archival
  - Legitimate audit activities
level: medium

YARA Rule

rule CVE_2026_73440_Arista_SNMPv3_Localized_Key_Exposure
{
    meta:
        description = "Detects Arista EOS configuration artifacts containing SNMPv3 localized key material associated with CVE-2026-73440"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73440"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $snmpv3_group = "snmpv3" ascii nocase
        $localized    = "localized" ascii nocase
        $user_kw      = "snmp-server user" ascii nocase
        $auth_kw      = "auth" ascii nocase
        $priv_kw      = "priv" ascii nocase
        $hash_a       = /\$[0-9a-fA-F]{32,64}\$/ ascii
        $hexblob      = /[0-9a-fA-F]{40,128}/ ascii

    condition:
        filesize < 10MB and
        (
            ($user_kw and $snmpv3_group and $localized) or
            ($user_kw and $snmpv3_group and ($hash_a or $hexblob))
        )
}

Suricata IDS Rule

alert udp any any -> any 161 (msg:"CVE-2026-73440 Possible SNMPv3 Credential Reuse / Anomalous SNMPv3 GetRequest Against Arista EOS"; flow:stateless; content:"|30|"; depth:1; content:"|04|"; content:"|a0|"; byte_test:1,=,3,0,relative; byte_test:1,>,0,0,relative; threshold: type both, track by_src, count 50, seconds 60; classtype:attempted-recon; reference:cve,2026-73440; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73440; metadata:service snmp; sid:7344001; rev:1;)

alert udp any any -> any 162 (msg:"CVE-2026-73440 Possible Fraudulent SNMP Trap to NMS Following Arista EOS Credential Exposure"; flow:stateless; content:"|30|"; depth:1; content:"|a7|"; byte_test:1,>,0,0,relative; threshold: type both, track by_src, count 20, seconds 60; classtype:attempted-admin; reference:cve,2026-73440; metadata:service snmp; sid:7344002; rev:1;)

Note: these rules flag anomalous SNMPv3 and trap volume consistent with credential reuse; they do not decode the localized key itself. Tune thresholds to baseline NMS polling rates.

Elastic Detection

sequence by host.id with maxspan=15m
  [ process where event.type == "start" and
      process.name : ("cli", "eos-cli", "FastCli") and
      process.args : "*show running-config*" ]
  [ authentication where event.category == "authentication" and
      event.outcome == "success" and
      user.name : "*" and
      process.name : ("snmpget", "snmpwalk", "snmptrap", "snmpbulkget") ]

Splunk SPL Query

index=network sourcetype=arista:eos OR sourcetype=cisco:ios OR sourcetype=snmp:*
| eval cfg_read = if(match(_raw, "(?i)show\s+running-config|copy\s+running-config"), 1, 0)
| eval snmpv3_exposed = if(match(_raw, "(?i)snmpv3") AND match(_raw, "(?i)localized|[$][0-9a-fA-F]{32,64}[$]"), 1, 0)
| eval snmp_activity = if(match(_raw, "(?i)snmpget|snmpwalk|snmpbulkget|snmptrap|snmpv3"), 1, 0)
| stats count values(snmpv3_exposed) as snmpv3_flag values(cfg_read) as cfg_flag
        by src_ip, dest_ip, user, host
| where snmpv3_flag > 0 OR (cfg_flag > 0 AND snmp_activity > 0)
| sort - count
| table host, src_ip, dest_ip, user, cfg_flag, snmpv3_flag, count

Wazuh OSSEC Rule

<group name="arista,eos,snmp,cve-2026-73440,">
  <rule id="734400" level="8">
    <decoded_as>json</decoded_as>
    <field name="CommandLine">show running-config</field>
    <description>CVE-2026-73440: Arista EOS configuration read detected - potential SNMPv3 localized key exposure</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>

  <rule id="734401" level="10">
    <if_sid>734400</if_sid>
    <match>snmpv3|localized</match>
    <description>CVE-2026-73440: SNMPv3 localized keying material present in Arista EOS configuration output</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>

  <rule id="734402" level="12">
    <decoded_as>snmp</decoded_as>
    <match>snmpv3</match>
    <description>CVE-2026-73440: Anomalous SNMPv3 operation possibly using exposed Arista EOS localized credential</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). No affected-version list, vendor fix reference, or workaround was published in the intelligence provided. Arista states the issue was discovered internally with no known malicious exploitation. Until a vendor fix is confirmed, treat all EOS devices with SNMPv3 as suspect.

1) Immediate mitigations

• Restrict access to configuration data. Enforce least privilege on management accounts so that read access to running-config (and to sanitized/technical-support bundles) is limited to the smallest necessary group. Remove running-config visibility from unprivileged roles.
• Harden the sanitized-config pipeline. Treat sanitized configuration exports as sensitive until the vendor confirms redaction is fixed: restrict access to the storage location, encrypt at rest and in transit, purge historical support bundles and configuration backups, and require explicit approval/NDA handling for third parties.
• Segment and protect the management plane. Isolate management interfaces from untrusted networks, restrict SNMP endpoints (UDP 161/162) to specific NMS hosts, and disable SNMPv3 users that are not actively required.
• Re-key SNMPv3 users. If a configuration containing localized key material may have been exposed, reconfigure the affected SNMPv3 users so the engine-localized keys are regenerated, and remove stale users.
• Harden the NMS. Apply trap-source authentication, rate-limit inbound traps, and alert on trap traffic originating from unexpected sources, since forged traps are the integrity-impacting path.

2) Patch/upgrade steps

• Monitor Arista's security advisory channel and the NVD entry for CVE-2026-73440 for a fixed EOS release train. No fixed train is identified in the data provided.
• When a fix is published: record current EOS versions, stage the upgrade in a lab running representative SNMPv3 configuration, verify that show running-config no longer emits localized keying material, then roll out to production.
• After upgrading, re-verify that SNMPv3 users function with newly generated, non-exposed credentials and that sanitized bundles are indeed sanitized.

3) Long-term hardening

• Automate configuration-output redaction testing in CI/support workflows so CWE-212 class leaks are caught before packages leave the environment.
• Inventory all locations where running/sanitized configurations are stored or transmitted; add these to data-classification and DLP scope.
• Adopt certificate-based or kerberos-backed SNMPv3 authentication where the platform supports it, reducing reliance on passphrase-derived localized keys.
• Maintain continuous monitoring (see Detection Guidance) for config-read followed by SNMP activity correlation.

References

• NVD — CVE-2026-73440: https://nvd.nist.gov/vuln/detail/CVE-2026-73440
• Arista Security Advisories (vendor advisory portal): https://www.arista.com/en/support/advisories-notices
• CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer: https://cwe.mitre.org/data/definitions/212.html
• RFC 3414 — User-based Security Model (USM) for SNMPv3 (key localization mechanics): https://www.rfc-editor.org/rfc/rfc3414
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/

Threat actor / exploit-in-the-wild status: No public PoC, Nuclei template, or exploit code is available for CVE-2026-73440. CISA KEV listing: none. EPSS 0.00255 (17.3rd percentile). Arista explicitly states it is not aware of any malicious exploitation of this vulnerability in customer networks. No named threat-actor campaign has been associated with this CVE in the data provided.