CVE-2026-73454

Executive Summary

CVE-2026-73454 is an OS command injection vulnerability (CWE-77) affecting platforms running Arista EOS with the gRPC Network Security Interface (gNSI) Credentialz service enabled. An authenticated attacker with low privileges who can reach the gRPC interface can issue a specially crafted request that causes unintended modification of a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended. With a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw is network-reachable, low-complexity, and has high confidentiality and integrity impact — a serious risk for any organization exposing EOS management-plane gRPC services.

Technical Analysis

Arista EOS is a network operating system for Arista switching and routing hardware. Its management plane exposes multiple programmable interfaces, including gRPC. The gRPC Network Security Interface (gNSI) is a set of gRPC-based services that allows external management controllers to configure and read "security" related state — including, per the NVD description, "Credentialz" (credential management). When Credentialz is configured, a management client can interact with the device to manage credential-related account properties.

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). This is the OS command injection family. In this class, user-supplied input that reaches a command-execution sink is not properly sanitized, allowing an attacker to alter the semantics of a command, inject additional commands or arguments, or otherwise cause a command to operate on parameters the original developer did not intend. The NVD description is explicit about the observable outcome: a "specially crafted request can cause unintended modifications to the target account's properties," and this "may result in the account being assigned elevated privileges or access beyond what an administrator intended."

Translating that into the vulnerability mechanism: the Credentialz gRPC handler processes request fields that describe credentials and account attributes on the target EOS device. Because special elements are not neutralized in those fields, an attacker who is authorized to call the interface (PR:L — low privileges, network-reachable, no user interaction) can craft a request whose input is interpreted by an underlying command/argument processing path rather than treated as inert data. The result is modification of account properties — privilege level, group membership, or access scope — for the attacker's target account, which is consistent with the high integrity (I:H) sub-score. The description does not enumerate specific request fields, RPC method names, or code paths, so those specifics are not asserted here.

Key attack-surface characteristics from the data:

• The flaw is in the network-facing gRPC service, so reachability depends on whether the gRPC API is enabled and exposed beyond an isolated management segment/VLAN.
• The interface requires authentication (PR:L), meaning an attacker needs valid low-privilege credentials on the gRPC control plane or a way to obtain them — this raises the bar slightly but is common in environments with shared automation credentials.
• No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning a scripted, repeatable request is sufficient.
• Scope is unchanged (S:U): impact is contained within the affected EOS device's security authority, but within that authority it is severe for both confidentiality and integrity.

Exploitation Scenarios

No public Proof-of-Concept, exploit code, or Nuclei template is available for this CVE. The following chain is described at the vulnerability-class level and strictly limited to the facts in the NVD description. No specific function names, RPC method names, gRPC service paths, or parameter names are invented.

1. Reconnaissance / target identification. The attacker identifies an Arista EOS device whose management plane exposes the gRPC API and on which the gRPC Network Security Interface (gNSI) Credentialz service is configured. Discovery is network-based: scanning for the gRPC listener on exposed management VLANs or management subnets, fingerprinting Arista device banners/certificates, and checking whether the gRPC interface responds. Because the CVSS vector is AV:N, the interface is assumed remotely reachable; operators frequently expose management APIs from out-of-band management networks.

2. Triggering the flaw. The attacker authenticates to the gRPC control plane with low privileges (PR:L). They then construct a request to the Credentialz service that carries input which the underlying command-processing path does not neutralize (CWE-77). Because the request reaches a command-execution sink without proper neutralization, the attacker controls elements that should have been treated as data. This is the crux of the exploit: the "specially crafted request" is the injection vehicle.

3. Payload / execution. The injected content alters the operation the backend performs on the target account's credential/account properties. The NVD description frames the effect as modification of account properties rather than arbitrary shell execution, but both are consequences of the same CWE-77 class. At the class level: command/argument injection lets the crafted request specify or override attributes (for example, privilege/role assignment or access scope) of the target account, effectively repurposing the Admin's own credential-management operation against the Admin's intent.

4. Post-exploitation impact. The attacker's target account is assigned elevated privileges or access beyond administrator intent (I:H). With the account now over-privileged, the attacker can read sensitive device and configuration state (C:H), pivot to other managed network elements using the compromised device's trust relationships, modify routing/ACLs or other device configuration, and persist — for example by retaining an over-privileged account. The result is a management-plane compromise of an EOS device, which in a switched/routed network is a high-value position for lateral movement.

Caveat: exploitation specifics remain unconfirmed in the absence of a vendor advisory, patch, or public PoC. Attackers may require slightly different request construction depending on the exact EOS build, which is not disclosed in the provided data.

Impact Assessment

• Confidentiality (C:H — High): An over-privileged account on a network device can read configuration, secrets (e.g., credential material present in config state), control-plane information, and traffic metadata. A compromised EOS device also exposes the management plane of the network.
• Integrity (I:H — High): The core impact of this CVE is unauthorized modification — account properties and privilege assignments. An attacker who can silently elevate an account's rights can also alter other device state under that account's expanded authority.
• Availability (A:N — None): The description does not indicate loss of availability; the vulnerability is a permissions/command-injection flaw, not a DoS. However, a management-plane compromise can lead to availability loss indirectly if the attacker reconfigures the device.
• Attack vector (AV:N, AC:L): Remotely exploitable with low complexity — a single crafted gRPC request. This makes automation and broad scanning feasible.
• Privileges required (PR:L) / UI:N: The attacker needs a low-privilege, authenticated foothold on the gRPC interface but no human victim interaction, so attacks can run unattended at scale.
• Scope (S:U): Impact remains within the affected device's authorization scope, but trust relationships between management systems commonly extend real-world blast radius beyond one device.

Business impact: unauthorized privilege escalation on network infrastructure undermines the entire trust model of the management plane. In regulated environments, this can be a material control failure (unauthorized access to network devices, change management bypass). Blast radius includes every EOS device running gNSI Credentialz that is reachable from the attacker's position; in a typical campus/DC deployment that can be dozens to thousands of switches.

Detection Guidance

Sigma Rule

title: Arista EOS gNSI Credentialz Command Injection Attempt (CVE-2026-73454)
id: 8c1f7e42-9a3b-4d55-b0e1-3f2a7c9d6e10
status: experimental
description: Detects suspicious gRPC Credentialz account-property modification requests against Arista EOS gNSI, indicative of CWE-77 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73454
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: arista
  service: eos
detection:
  selection_interface:
    - 'gNSI'
    - 'Credentialz'
    - 'Grpc'
  selection_action:
    - 'account'
    - 'credential'
    - 'privilege'
    - 'modify'
  selection_anomaly:
    - '*;*'
    - '*|*'
    - '*`*'
    - '*$(*'
    - '*&&*'
    - '*../*'
  condition: selection_interface and selection_action and selection_anomaly
falsepositives:
  - Legitimate automation using unusual credential strings
level: high
tags:
  - attack.t1190
  - cve.2026.73454

YARA Rule

rule CVE_2026_73454_Arista_EOS_gNSI_Credentialz_Injection
{
    meta:
        description = "Detects command-injection patterns targeting Arista EOS gNSI Credentialz (CVE-2026-73454, CWE-77)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73454"
        date = "2026-01-01"
        severity = "high"

    strings:
        $svc1 = "Credentialz" ascii nocase
        $svc2 = "gNSI" ascii nocase
        $grpc = "grpc" ascii nocase

        $inj1 = ";" ascii
        $inj2 = "&&" ascii
        $inj3 = "||" ascii
        $inj4 = "`" ascii
        $inj5 = "$(" ascii
        $inj6 = ">/" ascii

        $acct1 = "privilege" ascii nocase
        $acct2 = "account" ascii nocase
        $acct3 = "credential" ascii nocase

    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x0A0D0A0D or
        (($svc1 or $svc2) and $grpc and 1 of ($inj*) and 1 of ($acct*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-73454 Arista EOS gNSI Credentialz Command Injection Attempt"; flow:established,to_server; content:"Credentialz"; nocase; content:"|3b 20|"; within:200; pcre:"/(\x3b|\x26\x26|\x7c\x7c|\x60|\x24\x28).{0,50}(privilege|account|credential)/i"; reference:cve,2026-73454; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73454; classtype:attempted-admin; sid:202673454; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence High;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ network where network.transport == "tcp" and destination.port in (9090, 9339, 50051) and process.name != null ]
  [ process where event.action == "start" and process.args like~ ("*Credentialz*", "*gNSI*", "*privilege*") ]

Splunk SPL Query

index=network OR index=arista sourcetype="arista:eos" OR sourcetype="grpc:access"
| search ("Credentialz" OR "gNSI" OR "grpc")
| search ("modify" OR "account" OR "privilege" OR "credential")
| regex _raw="(?i)(;|&&|\|\||`|\$\().{0,60}(privilege|account|credential)"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by host, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="arista,eos,cve-2026-73454,">
  <rule id="2026734" level="12">
    <decoded_as>json</decoded_as>
    <field name="service">gNSI|Credentialz</field>
    <field name="action">modify_account|set_privilege|credential_change</field>
    <regex type="pcre2">(?i)(;|&amp;&amp;|\|\||`|\$\().{0,60}(privilege|account|credential)</regex>
    <description>CVE-2026-73454: Possible Arista EOS gNSI Credentialz command injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73454,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The following guidance is based on the vulnerability class and standard network-management-plane hardening; it is not a vendor-confirmed fix.

1. Immediate mitigations

• Restrict reachability to the gRPC API. Apply control-plane ACLs and firewall rules so only trusted management hosts can reach the EOS gRPC listener. Never expose gRPC/gNSI to untrusted or user networks.
• If gNSI Credentialz is not actively used, disable the gRPC service or the Credentialz configuration entirely on affected devices. Reduces attack surface to zero for the vulnerable code path.
• Enforce least privilege on all gRPC/API credentials: rotate any shared automation credentials that could satisfy PR:L, and remove unused API accounts.
• Monitor admin accounts for unexpected privilege changes and alert on any account-property modification made via gNSI.
• Treat the management plane as a tiered, segregated enclave (dedicated OOB management VLAN, jump hosts, no direct internet exposure).

2. Patch / upgrade steps

• No patch reference is available from tracked sources at this time. Verify status directly with Arista: check the Arista Security Advisory portal (arista.com/en/support/advisories-notices) and the Arista EOS release notes for CVE-2026-73454.
• Once a fixed EOS version is published, stage in a lab, validate that gNSI Credentialz functions normally, then upgrade affected devices during a maintenance window. Keep a rollback plan.
• Because no patch is confirmed, do not assume a specific EOS train is fixed; require explicit vendor confirmation per platform and release.

3. Long-term hardening

• Adopt a management-plane architecture that assumes device APIs are hostile-reachable: least privilege, short-lived credentials, and per-device authentication.
• Enable centralized audit logging of all gRPC/API calls, including caller identity, method, and request parameters, and forward off-box.
• Integrate EOS configuration and account state into a configuration-drift/change-detection system (e.g., compare running account privileges against a golden baseline) to catch unintended privilege assignments.
• Apply defense in depth: RBAC on API clients, MACsec/IPsec for management transport, and MFA at the jump-host layer.
• Track Arista advisories and subscribe to vendor security notifications for timely patch response.

References

• NVD — CVE-2026-73454: https://nvd.nist.gov/vuln/detail/CVE-2026-73454
• Arista Security Advisories portal (vendor advisory expected; no advisory reference in provided data): https://www.arista.com/en/support/advisories-notices
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): https://cwe.mitre.org/data/definitions/77.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73454 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score assigned as of this report): https://www.first.org/epss/

Threat actor campaigns / exploit-in-the-wild: No evidence is available in the provided data. CISA KEV status is NO, no public PoC or exploit code is known, and no EPSS score has been assigned. This report reflects the absence of confirmed in-the-wild exploitation; defenders should treat attempted exploitation as plausible given the low-complexity, network-reachable nature of the flaw.