CVE-2026-73447: Arista EOS Privilege Escalation Vulnerability

CVE-2026-73447 Overview

CVE-2026-73447 is a command injection vulnerability affecting Arista EOS-based products. The flaw resides in the gRPC Network Security Interface (gNSI) Certz service and also impacts the Bootz service. An authenticated user with sufficient privileges can send a crafted Certz Rotate request to execute arbitrary operating system commands as root. Successful exploitation leads to full device compromise, including confidentiality, integrity, and availability impact on the affected network device and any connected systems. The vulnerability is classified under CWE-78: OS Command Injection.

Critical Impact
A privileged, authenticated attacker can execute arbitrary OS commands with root privileges on Arista EOS devices, resulting in complete device takeover.

Affected Products

Arista EOS-based products exposing the gNSI Certz service
Arista EOS-based products exposing the gNSI Bootz service
Network devices running vulnerable EOS releases as enumerated in Arista Security Advisory 0162

Discovery Timeline

2026-09-16 - CVE-2026-73447 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73447

Vulnerability Analysis

The vulnerability exists in the gNSI Certz service implementation on Arista EOS. The gNSI protocol provides a gRPC-based interface for managing network device security operations, including certificate rotation through the Certz Rotate remote procedure call. The service fails to sanitize input fields before passing them to an underlying OS command execution path. An authenticated user with elevated gRPC privileges can embed shell metacharacters or command sequences into a crafted Certz Rotate request. The device then executes the injected commands with root privileges. The Bootz service, which handles secure bootstrap operations, exhibits the same class of flaw.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Fields within the Certz Rotate request are concatenated into shell invocations without adequate validation or safe-argument passing. The gNSI service runs as root, so any injected command inherits full system privileges. Refer to the Arista Security Advisory 0162 for the affected code paths and fixed versions.

Attack Vector

The attack vector is network-based. The attacker requires authenticated access with high privileges to the gNSI gRPC endpoint. No user interaction is required. Once authenticated, the attacker issues a Certz Rotate gRPC call containing crafted certificate-related payload fields that embed shell commands. The device executes those commands as root, allowing installation of persistent backdoors, extraction of configuration and credentials, or lateral movement into the management plane.

No verified public exploit code is available. See the Arista Security Advisory 0162 for vendor-provided technical details.

Detection Methods for CVE-2026-73447

Indicators of Compromise

Unexpected gNSI Certz.Rotate or Bootz gRPC requests originating from non-management hosts
Shell metacharacters such as ;, |, `, $( inside certificate or filename fields captured in gNSI audit logs
New root-owned processes, cron entries, or SSH keys appearing on EOS devices without a corresponding change ticket
Outbound connections from EOS management interfaces to unrecognized external hosts

Detection Strategies

Enable and centralize EOS AAA accounting and gNSI service logs to a SIEM for correlation of Certz Rotate calls with subsequent shell activity.
Baseline legitimate gNSI clients and alert on Certz or Bootz RPC calls from any source outside that allowlist.
Inspect gRPC payloads at TLS termination points on management jump hosts for shell metacharacters in certificate rotation fields.

Monitoring Recommendations

Forward EOS syslog, eos-agent events, and gNSI transaction logs to a centralized logging platform for retention and analytics.
Monitor for privilege changes, new local accounts, and modifications to /mnt/flash/startup-config on EOS devices.
Track authentication anomalies against gRPC management endpoints, including repeated failed mutual TLS handshakes.

How to Mitigate CVE-2026-73447

Immediate Actions Required

Apply the fixed EOS release identified in Arista Security Advisory 0162 to all affected devices.
Restrict access to the gNSI Certz and Bootz gRPC services to a dedicated management network and known controllers only.
Rotate all credentials, certificates, and API tokens used by gNSI clients after patching to invalidate any material an attacker may have exfiltrated.
Audit device configurations, local user accounts, and SSH authorized keys for unauthorized changes.

Patch Information

Arista has published fixed EOS releases in Arista Security Advisory 0162. Administrators should consult the advisory for the exact fixed versions corresponding to their EOS train and upgrade accordingly. Verify image integrity using vendor-published hashes before deployment.

Workarounds

Disable the gNSI Certz and Bootz services on devices where they are not operationally required.
Enforce control-plane access control lists (ACLs) that permit gRPC management traffic only from trusted orchestration hosts.
Require mutual TLS with strict certificate validation for all gNSI clients and limit the set of gRPC roles that can invoke Certz.Rotate.
Apply role-based access control on EOS to ensure that only a minimal set of accounts holds the privilege level required to reach the vulnerable RPC.

bash

# Example: restrict gRPC management-plane access on Arista EOS
management api gnmi
   transport grpc default
      vrf MGMT
      ip access-group GRPC-MGMT-ACL
!
ip access-list GRPC-MGMT-ACL
   10 permit tcp 10.0.10.0/24 any eq 6030
   20 deny ip any any log