On Arista EOS platforms running OpenConfig-related services, sensitive information such as CLI commands containing passwords and OpenConfig YANG leaf secrets may be logged in plaintext. This includes commands like "username bob secret myPass" and configuration data such as "system/aaa/global/tacacs/config/secret-key". These logs may reside locally on the device or on remote accounting servers. The vulnerability affects EOS versions from initial releases up to and including 4.36.1F. The issue was internally discovered by Arista with no known active exploitation. gRPC-based streaming telemetry to CloudVision is not impacted.

The vulnerability can lead to unintended exposure of sensitive credentials and secrets through logs stored locally or remotely, which could be accessed by unauthorized parties with access to these logs. This exposure could compromise confidentiality and potentially integrity and availability due to the CVSS vector indicating partial impact on all three. However, no known exploitation has been reported.

No official patch or fix is documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to logs and accounting servers to trusted personnel only and avoid logging sensitive commands or configuration changes if possible.