Incorrect default permissions in Arista Extensible Operating System (EOS) - CVE-2026-52895
Published: June 24, 2026
Vulnerability identifier: #VU135095
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52895
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to view and alter user credentials.
The vulnerability exists due to incorrect default permissions in the device when handling credential data for logged-in users. A local user can access and modify credential data to view and alter user credentials.
Exploitation is limited to users logged into the device.
Affected software
Arista Extensible Operating System (EOS)
How to mitigate CVE-2026-52895
Install security update from vendor's website.
Arista Extensible Operating System (EOS) - addressed in versions 4.33.9M, 4.34.8M, 4.35.6M, 4.36.1F