Description

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-16T19:17:32.270Z",
  "pubdate": "2026-09-16T19:17:32.270Z",
  "executiveSummary": "This vulnerability concerns a critical remote code execution (RCE) flaw within the Arista EOS operating system, specifically targeting the gRPC Network Packet Sampling Interface (gNPSI).\nThe vulnerability allows an unauthenticated, remote attacker to gain full administrative control over an affected network switch.\nBy transmitting a maliciously crafted gRPC request to the gNPSI endpoint, an attacker can bypass security controls to achieve arbitrary code execution.\nThe risk implication is severe, as the compromise grants the attacker complete control over the device, potentially allowing for network traffic interception, unauthorized configuration changes, or the establishment of a persistent foothold within the infrastructure.\nThe exploitation requirement is limited to the gNPSI feature being enabled on the target system. No authentication is necessary, lowering the barrier to entry for potential threat actors.\nOrganizations running Arista EOS are at significant risk if they utilize the gNPSI interface, as the lack of authentication allows for direct exploitation over the network.",
  "technicalDetails": "The vulnerability resides within the gRPC Network Packet Sampling Interface (gNPSI) component of Arista EOS. The root cause is improper input validation and insufficient authentication checks during the processing of incoming gRPC requests sent to the gNPSI service.\nThe gNPSI interface is designed to facilitate network packet sampling via gRPC; however, the service fails to verify the identity of the client connecting to the interface. Consequently, an attacker can establish a gRPC session with the switch without providing credentials.\nThe exploitation flow begins when an attacker identifies a target switch with gNPSI enabled and reachable over the network. The attacker crafts a malicious payload encapsulated within a gRPC request that targets internal functions or memory structures processed by the gNPSI service. When the target system receives and parses this request, the lack of sanitization allows the attacker to influence the program execution flow.\nBy manipulating the request, the attacker can trigger a memory corruption event or reach an unsafe code path that facilitates arbitrary code execution. Given the architectural role of gNPSI within the switch's ecosystem, the execution context often operates with high privileges, granting the attacker system-level access to the Arista EOS kernel or shell.\nPost-exploitation impact is total system compromise. Because the vulnerability results in code execution at the administrative level, the attacker can bypass existing access control lists (ACLs), exfiltrate sensitive configuration data, deploy unauthorized firmware or software updates, and maintain persistence. The attack is particularly effective as it utilizes the legitimate gRPC protocol, potentially blending in with standard management traffic if monitoring is not deep-packet inspection (DPI) enabled.\nThe attack is characterized by its ability to circumvent standard authentication mechanisms, making it a critical threat to network integrity. Because gNPSI exposes a direct interface for interaction with switch internals, successful exploitation is nearly instantaneous upon receipt of the payload, provided the service is active."
}