## Summary
Arista EOS contains a policy-enforcement flaw involving gNSI Pathz rules applied to gNMI access. When both a group rule and a user rule target the same path, gNMI may fail to correctly enforce the intended restrictions, allowing an authenticated user to gain unauthorized read/write access to gNMI paths.
## Technical Details
- Preconditions (per advisory):
- Arista EOS with OpenConfig configured
- A gNMI server running on the system
- gNSI Pathz configured and a gNSI Pathz policy present
- The policy contains both a group rule and a user rule for the same path
- Resulting behavior:
- gNMI may not correctly enforce gNSI Pathz rules under the above conditions
- An authenticated user can obtain unauthorized permissions to read or write gNMI paths that the Pathz policy is intended to restrict
- CWE mapping: CWE-842 (Placement of User into Incorrect Group)
## Affected
- EOS versions:
- 4.36.0.1F and below releases in the 4.36.x train
- 4.35.5M and below releases in the 4.35.x train
- 4.34.6M and below releases in the 4.34.x train
- From 4.33.2F through 4.33.8M in the 4.33.x train
- Affected platforms (Arista EOS-based products listed in the advisory):
- 710, 720D, 720XP/722XPM, 750X, 7010TX, 7020R/R4, 7130, 7170, 7050X3/X4, 7060X/X2/X4/X5/X6, 7260X/X3, 7280R/R2/R3/R4, 7300X/X3, 7320X, 7358X4, 7368X4, 7388X5, 7500R/R2/R3, 7800R3/R4, 7700R4
- AWE 5000, AWE 7200R, CloudEOS, cEOS-lab, vEOS-lab
- CloudVision eXchange (virtual or physical)
## Impact
- Unauthorized access to gNMI paths:
- Confidentiality impact: unauthorized read of restricted gNMI paths
- Integrity impact: unauthorized write to restricted gNMI paths
- Attack prerequisites:
- Requires an authenticated user (per advisory description)
- Network-based access (AV:N) to the gNMI service
## Mitigation
1. Upgrade Arista EOS to a version not listed as affected in the advisory (the advisory enumerates affected version ranges/trains).
2. Review gNSI Pathz policies for any paths where both a group rule and a user rule are defined for the same path; adjust policy structure to avoid overlapping rules for the same path.
3. If you do not require gNMI/OpenConfig/gNSI Pathz, disable or remove the relevant configuration to eliminate the vulnerable enforcement path.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-842