{"schemaVersion":3,"id":"CVE-2026-73440","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.","dates":{"published":"2026-09-16T09:55:14.571Z","modified":"2026-09-16T13:40:25.872Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.2,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":2.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":2.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.2,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00266,"percentile":0.1764,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.010999999999999985,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00255},"history":[{"date":"2026-09-16T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00266,"percentile":0.1764}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00266,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00266,"percentile":0.1764}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-212","name":"Improper Removal of Sensitive Information Before Storage or Transfer","description":"The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/212.html"}],"affected":[{"vendor":"arista networks","product":"eos","name":"EOS","label":"eos","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.36.0F, ≤ 4.36.1F","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.35.0F, ≤ 4.35.5M","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.34.0F, ≤ 4.34.7.1M","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.33.0F, ≤ 4.33.9M","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.0.0, < 4.33.0F","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.36.0F, ≤ 4.36.1F | ≥ 4.35.0F, ≤ 4.35.5M | ≥ 4.34.0F, ≤ 4.34.7.1M | ≥ 4.33.0F, ≤ 4.33.9M | ≥ 1.0.0, < 4.33.0F","eol":null,"hubHref":"/vendor/arista_networks/eos"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24734-security-advisory-0178","label":"www.arista.com/en/support/advisories-notices/security-advisory/24734-security-advisory-0178","hostname":"www.arista.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-16T09:55:14.571Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-16T13:40:25.872Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":17,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:35:28.513Z","stale":false,"partial":false}}