## Summary
Arista EOS gRPC Network Management Interface (gNMI) has a code-injection issue where a specially crafted request from a malicious authenticated client with gNMI access could lead to arbitrary code execution with root privileges on the switch. Arista reports no known malicious exploitation in customer networks.
## Technical Details
- Affected condition: Arista EOS with gNMI enabled.
- Weakness class: CWE-94 Improper Control of Generation of Code ('Code Injection').
- Attack model (from advisory/NVD): network-reachable, requires a client that is already authenticated to gNMI.
- The crafted request can result in arbitrary code execution with root privileges.
- CVSS (from advisory): 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
## Affected
- Arista EOS versions:
- 4.36.0.1F and below releases in the 4.36.x train
- 4.35.5M and below releases in the 4.35.x train
- 4.34.7M and below releases in the 4.34.x train
- 4.33.8M and below releases in the 4.33.x train
- All releases in the 4.32.x, 4.31.x, 4.30.x, and 4.29.x trains
- DANZ Monitoring Fabric (DMF):
- DMF deploys a fixed EOS on certain managed fabric switches; if that bundled EOS version is within the affected ranges, those switches may be impacted.
- DMF fabric switches running Switch Light OS are not affected.
## Impact
- Root-level arbitrary code execution on the switch.
- High confidentiality/integrity/availability impact consistent with CVSS C:H/I:H/A:H.
## Mitigation
1. Verify exposure by checking the running EOS version against the advisory’s “Affected Software” list.
2. If the EOS version is affected and gNMI is enabled, upgrade to a non-affected EOS release (per the advisory’s guidance).
3. For DMF environments, confirm the bundled EOS version on managed fabric switches; if it falls in the affected ranges, remediate accordingly (DMF Switch Light OS is not affected).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-94