The vulnerability allows an attacker to send a specially crafted password when password authentication is enabled on Arista EOS. The malformed credential creates orphan authentication sessions, gradually draining the system’s authentication session pool. When the pool is exhausted legitimate users will be unable to log in, causing a denial‑of‑service condition that affects the device’s availability. The weakness is an improper handling of authentication data, mapped to CWE‑116.

Affected platforms are Arista Networks EOS where password‑based authentication is configured, including Telnet and SSH services. The fix is included in EOS releases 4.36.1F and later in the 4.36.x train, 4.35.6M and later in the 4.35.x train, 4.34.8M and later in the 4.34.x train, and 4.33.9M and later in the 4.33.x train.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is 0.00343 (< 1 %), and the vulnerability is not listed in CISA KEV, so there is no current evidence of widespread exploitation. The likely attack vector is via remote password authentication attempts over Telnet or SSH, which an attacker could perform from an external host if that service is enabled. Because the flaw leaks authentication sessions, even automated login scripts can trigger it, making the risk higher for systems exposed to the internet.