Arista EOS: Path traversal in eAPI allows reading arbitrary files
Summary
An unauthenticated remote attacker can send a specially crafted HTTP request to affected Arista EOS switches and read arbitrary files from the switch filesystem, including sensitive credentials. The flaw applies only where the eAPI service is enabled and reachable over the network. The CVSS 4.0 base score is 8.7 (High), but the NVD analysis is still pending.
Affected
- EOS 4.36.0F to 4.36.3M
- EOS 4.35.0F to 4.35.7M
- EOS 4.34.0F to 4.34.9M
- EOS 4.33.0F to 4.33.11M
- EOS 4.32.0F before 4.33.0F
- EOS 1.0.0 before 4.32.0F
- Only if the eAPI service (management http-commands) is enabled
- Source: CVE record (CNA Arista); the default configuration is unaffected
Fixed in
Unknown. The vendor advisory could not be verified. Do not assume any version is fixed. Obtain the fixed builds for each EOS train from the Arista advisory or your Arista support contact.
Workaround
- Disable the eAPI HTTP service if it is not needed (no default-services, protocol http removed or shut down).
- Restrict access to the management plane to trusted admin networks.
- Check the vendor advisory for further vendor-recommended workarounds.
Exploitation
- Not known to be exploited according to a third-party tracker.
- Not listed in CISA KEV.
- Public proof-of-concept status: unknown, not yet verified.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Check whether eAPI is enabled on each Arista switch and whether it is reachable from user, guest or internet networks.
- Disable eAPI or restrict it to a management VLAN until fixed builds are confirmed.
- Obtain fixed builds from Arista and patch affected switches as soon as possible.
- Rotate credentials on exposed switches, since they may have been read.
- Monitor HTTP access logs to the management interface for unusual requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-121371 www.cve.org
- Arista Security Advisory 0218 www.arista.com
- OffSeq radar entry radar.offseq.com
- Strix CVE-2026-121371 www.strix.ai
- threatint CVE-2026-121371 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:02.
Original description (NVD)
On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.