CVE-2026-73447 — Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

Back Back to CVE browser

CRITICAL

Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

Published Sep 16, 2026

9.4

CRITICAL

CVSS 4.0

EPSS 0.70%

Description

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.

Affected products

Vendor Arista Networks Product EOS Default
unaffected
- Version
  4.30.2F
  Status
  affected
  Constraints
  <4.31.0F
- Version
  4.31.0F
  Status
  affected
  Constraints
  <4.32.0F
- Version
  4.32.0F
  Status
  affected
  Constraints
  <4.33.0F
- Version
  4.33.0F
  Status
  affected
  Constraints
  <=4.33.8M
- Version
  4.34.0F
  Status
  affected
  Constraints
  <=4.34.7M
- Version
  4.35.0F
  Status
  affected
  Constraints
  <=4.35.5M
- Version
  4.36.0F
  Status
  affected
  Constraints
  <=4.36.0.1F

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Arista Networks

EOS

unaffected

Version	Status	Constraints
4.30.2F	affected	<4.31.0F
4.31.0F	affected	<4.32.0F
4.32.0F	affected	<4.33.0F
4.33.0F	affected	<=4.33.8M
4.34.0F	affected	<=4.34.7M
4.35.0F	affected	<=4.35.5M
4.36.0F	affected	<=4.36.0.1F

Remediation

Vendor solution

The following EOS releases contain the fix for this vulnerability: - 4.33.9M and later releases in the 4.33.x train - 4.34.7.1M and later releases in the 4.34.x train - 4.35.6M and later releases in the 4.35.x train - 4.36.1F and later releases in the 4.36.x train

No hotfix is available for this vulnerability.