{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 218 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218" } ], "title": "Security Advisory 218", "tracking": { "current_release_date": "2026-11-08T09:58:21Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 218", "initial_release_date": "2026-11-08T09:58:21Z", "revision_history": [ { "date": "2026-11-08T09:58:21Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.33.11.2", "product": { "name": "EOS version 4.33.11.2", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 4.35.7.2", "product": { "name": "EOS version 4.35.7.2", "product_id": "CSAFPID-4" } }, { "category": "product_version", "name": "EOS version 4.36.3.2", "product": { "name": "EOS version 4.36.3.2", "product_id": "CSAFPID-0" } }, { "category": "product_version", "name": "EOS version 1.0.0", "product": { "name": "EOS version 1.0.0", "product_id": "CSAFPID-2" } }, { "category": "product_version", "name": "EOS version 4.37.0", "product": { "name": "EOS version 4.37.0", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.34.9.2", "product": { "name": "EOS version 4.34.9.2", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-121371", "id": { "system_name": "Arista Bug ID", "text": "2048764" }, "notes": [ { "category": "description", "text": "On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.", "title": "CVE Description" }, { "category": "other", "text": "In order to be vulnerable to CVE-2026-121371, the following conditions must all be met:\n\n* eAPI is enabled and running\n* default-service is enabled\n\nNote: The conditions listed above reflect default system configurations. As a result, systems remain vulnerable even without custom or explicit configuration changes. \n\nTo check if eAPI service is running, use the following command:\n\n```cpp\nswitch>show management api http-commands \nEnabled: Yes\nHTTPS server: running, set to use port 443\nHTTP server: running, set to use port 80\nLocal HTTP server: shutdown, no authentication, set to use port 8080\nUnix Socket server: shutdown, no authentication\nVRFs: default\nHits: 0\nLast hit: never\nBytes in: 0\nBytes out: 0\nRequests: 0\nCommands: 0\nDuration: 0.0 seconds\nSSL Profile: ARISTA_DEFAULT_SELF_SIGNED_PROFILE, valid\nFIPS Mode: No\nQoS DSCP: 0\nSession Timeout: 1440 minutes\nLog Level: none\nCSP Frame Ancestor: None\nTLS Protocols: 1.0 1.1 1.2 1.3\nURLs \n---------------------------------------------------------\nManagement1 : https://10.0.0.1:443 \nManagement1 : http://10.0.0.1:80 \nManagement1 : https://[3fff:ffff::1]:443\nManagement1 : http://[3fff:ffff::1]:80 \n\n```\n\nTo Verify if default-service is enabled by examining running-config all:\n\n```\nswitch#show running-config all| sect http-server\nmanagement http-server\n protocol https port 443\n protocol http\n no protocol http localhost port 8080\n no protocol unix-socket\n qos dscp 0\n no log-level\n default-services\n no header csp frame-ancestors\n no cors allowed-origin\n no protocol https ssl profile\n```\n\nOr\n\n```\nswitch#show running-config all| sect http-commands\nmanagement api http-commands\n protocol https port 443\n no protocol http port 80\n no protocol http localhost port 8080\n no protocol unix-socket\n qos dscp 0\n no log-level\n default-services\n no header csp frame-ancestors\n ...\n```", "title": "2048764: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-2" ], "fixed": [ "CSAFPID-0", "CSAFPID-1", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121371" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.11.2", "product_ids": [ "CSAFPID-5" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.9.2", "product_ids": [ "CSAFPID-3" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.7.2", "product_ids": [ "CSAFPID-4" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.3.2", "product_ids": [ "CSAFPID-0" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.37.0", "product_ids": [ "CSAFPID-1" ] }, { "category": "none_available", "details": "Not fixed in EOS version 1.0.0", "product_ids": [ "CSAFPID-2" ] }, { "category": "mitigation", "details": "The recommended mitigation is to disable default services on the management HTTP server. Disabling the default services removes access to the built-in eAPI documentation/explorer (the web UI accessible to `https:///explorer.html`) and TapAgg GUI.\n\n```\nswitch(config)#management http-server \nswitch(config-mgmt-http-server)#no default-services\n\nswitch#show running-config | sect http-server\nmanagement http-server\n protocol http\n no default-services\n```\n\n Or\n\n```\nswitch(config)#management api http-commands \nswitch(config-mgmt-api-http-cmds)#no default-services \n\nswitch#show running-config | sect http-commands\nmanagement api http-commands\n protocol http\n no default-services\n no shutdown\n```" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0", "CSAFPID-4", "CSAFPID-2", "CSAFPID-1", "CSAFPID-3", "CSAFPID-5" ] } ], "title": "CVE-2026-121371" } ] }