« Volver al listado

CVE-2026-73440

Estado: Pendiente de análisisBaja (2.3)—

On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Arista — EOSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-73440",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73440",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-16T13:40:14.055400Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.6
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@arista.com",
      "affectedData": [
        {
          "vendor": "Arista Networks",
          "product": "EOS",
          "versions": [
            {
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom",
              "lessThanOrEqual": "4.36.1F"
            },
            {
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom",
              "lessThanOrEqual": "4.35.5M"
            },
            {
              "status": "affected",
              "version": "4.34.0F",
              "versionType": "custom",
              "lessThanOrEqual": "4.34.7.1M"
            },
            {
              "status": "affected",
              "version": "4.33.0F",
              "versionType": "custom",
              "lessThanOrEqual": "4.33.9M"
            },
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "4.33.0F",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7150 Series",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange, virtual or physical appliance"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-09-16T10:16:51.870",
  "references": [
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24734-security-advisory-0178",
      "source": "psirt@arista.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@arista.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-212"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
    }
  ],
  "lastModified": "2026-09-16T19:08:50.420",
  "sourceIdentifier": "psirt@arista.com"
}