CVE-2026-121371

HighCVSS 7.5/10Last modified Nov 12, 2026

Description

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Arista Networks	EOS	>= 4.36.0F, <= 4.36.3M; >= 4.35.0F, <= 4.35.7M; >= 4.34.0F, <= 4.34.9M; >= 4.33.0F, <= 4.33.11M; >= 4.32.0F, < 4.33.0F; >= 1.0.0, < 4.32.0F

References

https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1213735.3The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content at CVE-2026-1213749.4Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit ru CVE-2026-1213799.6The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before del CVE-2026-1213805.3The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to ret CVE-2026-1213827.5A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bi CVE-2026-1213867.5FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), whic CVE-2026-1213874.3FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to r CVE-2026-1213886.5FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large CVE-2026-1213893.1FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort CVE-2026-121395.5Tanium addressed an information disclosure vulnerability in Connect.CVE-2026-1213904.3FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing CVE-2026-1213914.3FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on