CVE-2026-73440 in EOS
Summary
by MITRE • 09/16/2026
On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified security flaw within Arista EOS operating systems presents a critical risk regarding the integrity of Simple Network Management Protocol version 3 authentication mechanisms. When SNMPv3 is configured on affected platforms, sensitive local or remote user credentials are inadvertently stored as one-way hashed localized key values directly within both the running configuration and sanitized backup configurations. This exposure occurs despite the use of hashing, which typically implies a level of protection for passwords; however, in this specific implementation context, the localization process combined with storage practices results in the credential material being accessible to any entity that can read these configuration files. The presence of these hashed keys in plaintext-readable format within standard configuration outputs represents a significant deviation from secure key management principles, as it allows an attacker who has obtained administrative or privileged access to extract authentication secrets without needing to crack complex passwords through brute force methods if the hash is reversible under specific conditions or if the localization process can be reverse-engineered given sufficient context.
From a technical perspective, this vulnerability aligns with CWE-798: Use of Hard-coded Credentials and CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The core issue lies in the improper handling of sensitive authentication data during configuration serialization or storage processes. By exposing localized key values that are derived from user passwords, the system effectively reduces the security boundary required for SNMPv3 operations. An authenticated attacker who gains access to these configurations can leverage this information to perform unauthorized read operations on SNMP tables, potentially extracting network topology details, interface statistics, routing table information, and other critical operational data. Furthermore, the exposure of these credentials enables the sending of fraudulent trap notifications to the Network Management System, which could be used to trigger false alarms, disrupt monitoring workflows, or mask actual malicious activities by flooding the NMS with deceptive alerts.
The operational impact of this vulnerability is substantial for organizations relying on SNMPv3 for network management and security monitoring. Since SNMPv3 provides authentication and encryption services, compromising its credentials undermines the trust model of the entire management plane. Attackers can impersonate legitimate management stations or agents, leading to a complete compromise of visibility into the network infrastructure. This capability facilitates further reconnaissance and lateral movement within the enterprise environment. The vulnerability is particularly dangerous because it affects both local and remote user accounts, expanding the attack surface beyond just console access to include any account with SNMP privileges that has been configured on the device. Although Arista reports no known malicious exploitation in customer networks at this time, the potential for abuse remains high given the ease of accessing configuration files once initial system compromise is achieved through other vectors such as SSH or web interface vulnerabilities.
Mitigation strategies should focus on immediate remediation and long-term architectural improvements. Administrators are advised to update their Arista EOS software to versions that address this specific flaw, ensuring that credential storage mechanisms adhere to industry best practices for secure hashing and key management. In the interim, it is crucial to restrict access to configuration files strictly to authorized personnel with a verified need-to-know basis, employing role-based access control to limit who can view or export running configurations. Additionally, organizations should audit their SNMPv3 implementations to ensure that only necessary users are granted privileges and that strong, complex passwords are used in conjunction with proper localization settings where applicable. Regular rotation of SNMP credentials further reduces the window of opportunity for attackers who may have previously accessed outdated configuration backups. Aligning these practices with MITRE ATT&CK techniques such as T1078: Valid Accounts and T1530: Data from Cloud or On-Premises Storage can help in monitoring for anomalous access patterns related to credential theft and unauthorized SNMP interactions, thereby enhancing the overall security posture of the network infrastructure.