CVE-2026-73467 in EOS
Summary
by MITRE • 09/15/2026
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability in question pertains to a critical security flaw within the Arista Extensible Operating System that results in the exposure of plaintext credentials associated with TACACS+ server configurations. In enterprise network environments, authentication, authorization, and accounting protocols such as TACACS+ are fundamental for securing administrative access to network infrastructure devices like switches and routers. These systems typically store shared secrets or keys used to encrypt communication between the device and the authentication servers. Under normal operational conditions, these sensitive values should be stored in an encrypted format within the configuration files to prevent unauthorized disclosure if the configuration is accessed by malicious actors or leaked through misconfigurations. However, due to a specific implementation error under certain circumstances, the system fails to properly obfuscate or encrypt these shared secrets when they are written to persistent storage or displayed during configuration retrieval operations.
This technical flaw represents a significant deviation from secure coding practices and industry standards regarding credential management. The issue aligns with CWE-312, which classifies vulnerabilities where confidential information is stored in cleartext without adequate protection mechanisms such as encryption at rest. By storing the TACACS+ shared secret in plaintext, the vulnerability effectively neutralizes one of the primary layers of defense designed to protect administrative credentials from local privilege escalation attacks or insider threats. If an attacker gains read access to the device's configuration files through a lower-privilege account, physical access to the hardware, or via another exploited vulnerability that allows file system traversal, they can immediately extract these plaintext secrets. This extraction does not require complex reverse engineering or decryption algorithms, making it trivial for any actor with basic command-line interface knowledge to harvest valid credentials.
The operational impact of this vulnerability is severe and multifaceted. TACACS+ shared secrets are used to authenticate the identity of the network device to the authentication server. If these secrets are compromised, an attacker can impersonate the affected Arista switch or router when communicating with the central authentication infrastructure. This capability allows for potential man-in-the-middle attacks where the attacker intercepts and potentially modifies administrative sessions authenticated by TACACS+. Furthermore, if the same shared secret is reused across multiple devices in a network segment—a common but discouraged practice—the compromise of one device could lead to a broader lateral movement scenario. Attackers can leverage these stolen credentials to bypass access controls, execute unauthorized commands, or disrupt critical network services, thereby compromising the integrity and availability of the entire infrastructure dependent on that authentication source.
From an adversarial perspective, this vulnerability facilitates techniques documented in the MITRE ATT&CK framework, specifically those related to Credential Access such as OS Credential Dumping (T1003) if local file access is achieved, or Network Service Scanning followed by Brute Force attacks using harvested credentials. The ease of obtaining these plaintext secrets lowers the barrier for entry significantly compared to vulnerabilities requiring complex exploitation chains. It effectively turns a configuration management oversight into a direct pathway for unauthorized administrative control over network devices.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately apply vendor-provided software updates that correct this encryption handling logic within the Arista EOS codebase. Until patches are available, it is imperative to audit configuration files manually or via automated scripts to identify any instances where TACACS+ shared secrets appear in plaintext format. Organizations must also enforce strict access controls on device configurations, ensuring that only highly privileged accounts can view full configuration details including sensitive parameters. Additionally, implementing network segmentation and monitoring for anomalous authentication patterns originating from compromised devices can help detect exploitation attempts early. Long-term mitigation involves adopting a zero-trust architecture where shared secrets are rotated frequently and never reused across different security domains, thereby limiting the blast radius of any single credential compromise.