{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 152 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24708-security-advisory-0152" } ], "title": "Security Advisory 152", "tracking": { "current_release_date": "2026-09-17T11:48:11Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 152", "initial_release_date": "2026-09-17T11:48:11Z", "revision_history": [ { "date": "2026-09-17T11:48:11Z", "number": "1", "summary": "Document created" } ], "status": "draft", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.34.8", "product": { "name": "EOS version 4.34.8", "product_id": "CSAFPID-0" } }, { "category": "product_version", "name": "EOS version 4.33.9", "product": { "name": "EOS version 4.33.9", "product_id": "CSAFPID-3" } }, { "category": "product_version", "name": "EOS version 4.36.1", "product": { "name": "EOS version 4.36.1", "product_id": "CSAFPID-4" } }, { "category": "product_version", "name": "EOS version 4.35.6", "product": { "name": "EOS version 4.35.6", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 1.0.0", "product": { "name": "EOS version 1.0.0", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-19641", "id": { "system_name": "Arista Bug ID", "text": "1595868" }, "notes": [ { "category": "description", "text": "On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.", "title": "CVE Description" }, { "category": "other", "text": "In order to be vulnerable to CVE-2026-19641, both of the following conditions must be met:\n\n1. Login authentication must be enabled, which is the default configuration.\n\nThe following command can be used to verify the login authentication methods.\n\nIf the \u201cmethods\u201d under \u201cAuthentication method lists for LOGIN\u201d does not show \u201cnone\u201d, that means login authentication is enabled.\n\n2. A service that accepts password-based authentication is enabled (e.g., SSH with password authentication, or telnet). By default, SSH with password authentication is enabled and telnet is disabled.\n\nFor SSH, use the following command to check whether it is enabled for any VRF.\n\nUse the following command to check if password-based authentication is enabled for SSH. SSH is vulnerable if \u201cpassword\u201d or \u201ckeyboard-interactive\u201d is listed.\n\nFor Telnet, use the following command to check whether it is enabled for any VRF. Telnet is vulnerable if enabled.\n\nThe device is vulnerable if login authentication is enabled and SSH with password-based method or Telnet is enabled.", "title": "1595868: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-2" ], "fixed": [ "CSAFPID-0", "CSAFPID-1", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19641" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.9", "product_ids": [ "CSAFPID-3" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.8", "product_ids": [ "CSAFPID-0" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.6", "product_ids": [ "CSAFPID-1" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.1", "product_ids": [ "CSAFPID-4" ] }, { "category": "none_available", "details": "Not fixed in EOS version 1.0.0", "product_ids": [ "CSAFPID-2" ] }, { "category": "mitigation", "details": "The workaround is to disable password based authentication services, such as Telnet and SSH.\n\nNOTE: This workaround only works for local authentication. There is no workaround if the device requires password authentication via a remote method, e.g. Terminal Access Controller Access-Control System Plus (TACACS+), Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP).\n\nUse the following command to disable Telnet.\n\nOn the client host, use the following command to generate SSH keys.\n\nCopy the SSH public key to the device and add it to the local user.\n\nAdd public-key as the first protocol for SSH authentication, keep keyboard-interactive as the second protocol for now.\n\nOnce you have verified that the user can know login without a password from the client host, remove keyboard-interactive from SSH authentication protocol configuration.\n\nWARNING: Incorrect configuration may block logins. Make sure public-key authentication works before removing keyboard-interactive from the configuration.\n\nInstead of public key, certificate-based authentication can also be used as a workaround for local users.\n\nPlease find more details about how to configure certificate-based authentication in the [SSH Certificates User Guide](https://www.arista.com/en/support/toi/eos-4-22-1f/14286-ssh-certificates)." } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-2", "CSAFPID-3", "CSAFPID-0", "CSAFPID-4", "CSAFPID-1" ] } ], "title": "CVE-2026-19641" } ] }