CVE-2026-73447

Executive Summary

CVE-2026-73447 is a command injection vulnerability (CWE-78) in the gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products; the Bootz service is also affected. An authenticated attacker who already holds privileged credentials can submit a crafted Certz Rotate request to execute arbitrary OS commands with root privileges, resulting in full device compromise. Because the flaw is remotely reachable (AV:N), requires high privileges (PR:H), and causes a scope change (S:C) with full confidentiality, integrity, and availability impact, it carries a CVSS v3.1 base score of 9.1. No public PoC, exploit code, or patch is currently available, and the CVE has not been added to CISA KEV or scored by FIRST.org EPSS.

Technical Analysis

Arista EOS-based products expose a gRPC-based management surface known as the gRPC Network Security Interface (gNSI). Within gNSI, the Certz service handles certificate lifecycle operations — the NVD description explicitly names the "Certz Rotate" request as the attack vector — while the Bootz service handles boot/credential provisioning functions and is stated to be affected as well.

The underlying weakness is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). In this class of flaw, user- or request-supplied input that reaches an OS command execution sink is not adequately sanitized, allowing an attacker to inject shell metacharacters or embed command syntax inside a value that the service later passes to a shell or command interpreter. Per the NVD description, a "privileged attacker can exploit certain operation to execute arbitrary commands with root privileges." The injection point is a crafted Certz Rotate request delivered to the gNSI Certz service; the command executes in the device's root context, granting full control of the EOS instance.

Key structural observations that are directly supported by the supplied data:

• Attack surface: network-exposed gRPC endpoints implementing the gNSI Certz (and Bootz) services on Arista EOS devices.
• Precondition: authentication plus high privilege ("an authenticated user," CVSS PR:H). The description characterizes the actor as both "a privileged attacker" and "an authenticated user," so the exploitable path begins after valid authentication with elevated rights.
• Primitive: OS command injection triggered by malformed input in a Certz Rotate request, executing as root.
• Privilege escalation: the CVSS vector encodes S:C (scope change), consistent with a process/service compromise escaping its intended security context to affect the broader device platform.

No CVE-specific function names, class names, file paths, gRPC method signatures, or parameter identifiers are provided in the source data. The specific input field within the Rotate request that carries the injected command, and the exact command-execution sink, are not disclosed. Any claim about particular API parameters or internal functions would be fabrication and is deliberately omitted.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-73447; the chain below is inferred strictly from the vulnerability class (CWE-78) and the attack surface named in the NVD description.

1. Reconnaissance / target identification. An attacker with network reachability to a management interface enumerates Arista EOS devices that expose the gRPC management surface, specifically the gNSI Certz service (and Bootz). Shodan-style discovery based on Arista EOS product banners, HTTP titles, or TLS certificate subject CN values can identify candidate devices; gRPC endpoints typically sit on networked management ports and can be fingerprinted via their gRPC/HTTP2 service descriptors.

2. Triggering the flaw class. The attacker first authenticates to the management surface. The NVD description requires high privileges (PR:H), so the actor holds valid, elevated credentials — for example a compromised administrative account, a credential obtained via prior lateral movement, or a delegated role with access to certificate operations. The attacker then issues a crafted "Certz Rotate" request to the Certz gRPC service. The crafted request embeds OS command syntax inside a value that the service later forwards to an OS-level command execution path without appropriate neutralization — the defining characteristic of CWE-78.

3. Payload/execution at the vulnerability-class level. Because input is not sanitized before reaching the command sink, injected shell metacharacters and command strings are interpreted by the underlying OS command interpreter rather than treated as inert data. The command runs with root privileges on the EOS device ("execute arbitrary commands with root privileges"). The equivalent injection surface on the Bootz service is also affected, providing a second delivery channel for the same flaw class.

4. Post-exploitation impact. Successful exploitation yields root-level command execution on the device, described as "full device compromise." From root, an adversary can read and exfiltrate device configuration and secrets, modify or disable security controls, pivot into the management network, and establish persistence on the platform. The CVSS scope change (S:C) reflects that the compromise can affect components beyond the vulnerable service itself.

Attacker prerequisites and constraints: this is not a pre-auth remote code execution flaw. It requires (a) network reachability to the gRPC management surface, and (b) authenticated access with high privilege. Consequently, it is most dangerous as a privilege-escalation and persistence primitive for an actor who has already obtained administrative foothold, or as a destructive/impact step for a rogue insider with delegated management rights.

Impact Assessment

The CVSS v3.1 base score is 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Sub-metric interpretation:

• AV:N (Network): the vulnerable gRPC Certz/Bootz services are reachable over the network rather than requiring local access.
• AC:L (Low): no special conditions or race conditions are required; the crafted request reliably triggers the flaw class.
• PR:H (High): the attacker must already possess privileged/authenticated access — this materially limits the exposed population but not the severity once the prerequisite is met.
• UI:N (None): no victim interaction is needed.
• S:C (Scope Changed): exploitation of the vulnerable service compromises the wider device platform, not just the component — consistent with root execution on the EOS instance.
• C:H / I:H / A:H: total loss of confidentiality (configs, keys, credentials), integrity (arbitrary command execution, control-plane tampering), and availability (potential to crash or brick the device / disrupt routing).

Blast radius: affected assets are Arista EOS-based network devices that expose the gNSI Certz and/or Bootz services. Given the role these devices play as network control-plane nodes, compromise can cascade to the entire fabric reachable through the device, making this a high-value lateral-movement and persistence objective for an adversary already operating within a management domain. No affected version list was provided, so the precise installed population cannot be scoped from this data alone; organizations must inventory EOS devices with gNSI certificate/boot services enabled.

Detection Guidance

Detection strategy focuses on anomalous gRPC management-plane activity against the gNSI Certz and Bootz services, command-injection indicators in process/log telemetry, and post-exploitation artifacts (unexpected root-spawned processes, config changes).

Sigma Rule

title: Potential CVE-2026-73447 gNSI Certz Command Injection Activity
id: 8c4e1a2f-7344-4cve-9a10-arista73447a
status: experimental
description: Detects anomalous gNSI Certz/Bootz gRPC service activity and shell interpreter execution associated with CVE-2026-73447 command injection on Arista EOS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73447
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: arista
  service: eos
detection:
  selection_service:
    service_name|contains:
      - 'Certz'
      - 'Bootz'
  selection_cmd:
    CommandLine|contains:
      - 'Rotate'
      - ';'
      - '&&'
      - '|'
      - '`'
      - '$('
  condition: selection_service and selection_cmd
falsepositives:
  - Legitimate certificate rotation operations via gNSI
  - Administrative maintenance using the Certz Rotate workflow
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.73447

YARA Rule

rule CVE_2026_73447_gNSI_Certz_CommandInjection
{
    meta:
        description = "Detects certificate-rotation request artifacts and shell metacharacter injection patterns associated with CVE-2026-73447 gNSI Certz command injection"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73447"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $svc1 = "Certz" ascii wide nocase
        $svc2 = "Bootz" ascii wide nocase
        $op1  = "Rotate" ascii wide nocase
        $inj1 = "$(" ascii
        $inj2 = "`" ascii
        $inj3 = "&&" ascii
        $inj4 = "; /" ascii
        $inj5 = "| /" ascii

    condition:
        (uint16(0) == 0x3C3F or filesize < 5MB) and
        (any of ($svc*)) and (any of ($op1)) and (1 of ($inj*))
}

Suricata IDS Rule

alert http2 any any -> any any (msg:"CVE-2026-73447 Arista EOS gNSI Certz Command Injection Attempt"; flow:established,to_server; content:"Certz"; http2_header_name; nocase; content:"Rotate"; nocase; pcre:"/(\$\(|`|;|\|\||&&)/"; threshold:type both, track by_src, count 5, seconds 60; reference:cve,2026-73447; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73447; classtype:attempted-admin; sid:202673447; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.action == "start" and
     process.parent.name : ("grpc*", "gnsi*", "certz*", "bootz*")]
  [process where event.action == "start" and
     process.name : ("sh", "bash", "busybox") and
     process.args : ("*$(*", "*`*", "*;*", "*&&*", "*||*")]

Splunk SPL Query

index=arista OR index=network sourcetype=eos:* OR sourcetype=arista:syslog
(service="Certz" OR service="Bootz" OR message="*Certz*" OR message="*Bootz*")
("Rotate" OR "rotate")
| regex message="(?i)(\\$\(|`|;|\|\||&&|/bin/sh|root)"
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as evidence by host, src, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="arista,eos,cve-2026-73447,">
  <rule id="2026734" level="12">
    <decoded_as>json</decoded_as>
    <field name="service">Certz|Bootz</field>
    <regex type="pcre2">(?i)(\$\(|`|;|\|\||&amp;&amp;)</regex>
    <description>CVE-2026-73447: Possible gNSI Certz/Bootz command injection attempt on Arista EOS device</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED, with no patch evidence from any tracked source. No vendor fix, workaround, or affected-version list was provided for this CVE. Treat the guidance below as interim risk reduction.

1. Immediate mitigations

• Restrict network access to the gRPC management surface: place gNSI endpoints (Certz and Bootz services) behind management ACLs, out-of-band management networks, or jump hosts. Ensure they are not reachable from general user or data-plane networks.
• Enforce least privilege: review which accounts possess the elevated rights needed to invoke certificate rotation on the Certz service. Every such account is a potential exploitation prerequisite (PR:H).
• Apply strong authentication and monitoring to privileged management accounts; rotate administrative credentials and certificates.
• Disable the gNSI Certz and/or Bootz services if they are not operationally required.
• Increase logging/alerting on management-plane activity (see Detection Guidance) to catch anomalous Rotate requests.

2. Patch/upgrade steps

• Monitor the Arista security advisory portal and NVD (CVE-2026-73447) for an official fix. As of this report, no patched release, version boundary, or workaround has been published in the tracked sources.
• Once a fixed EOS release is available, test it in a lab image, then stage the upgrade during a maintenance window. Maintain configuration backups before upgrading.
• Subscribe to Arista security notifications for this CVE ID to receive fixed-version mapping.

3. Long-term hardening

• Segment the management plane from production and user networks; enforce zero-trust access to gRPC/management interfaces.
• Enforce multi-factor authentication and granular RBAC for all privileged roles capable of certificate and provisioning operations.
• Enable and forward EOS audit/config-change logging, and retain for incident response.
• Perform regular inventory of devices exposing gNSI services and reduce exposed attack surface.
• Validate input handling and least-privilege execution in any custom integrations that call gNSI Certz/Bootz services.

References

• NVD — CVE-2026-73447: https://nvd.nist.gov/vuln/detail/CVE-2026-73447
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Arista Security Advisories portal (monitor for the CVE-2026-73447 advisory; none published in supplied data): https://www.arista.com/en/support/advisories-notices
• FIRST.org EPSS (no score yet assigned for CVE-2026-73447; re-check): https://api.first.org/data/v1/epss?cve=CVE-2026-73447

Threat actor / exploit-in-the-wild status: No known threat actor campaign or exploit-in-the-wild evidence is reported in the supplied data. CISA KEV: NO. Public PoC: None. Nuclei template: None. Exploit code: None.