This vulnerability involves a concurrent execution race condition (CWE-362) in the gNSI Authz service of Arista EOS. When multiple gNSI transports are configured, a race condition can cause policy rotations to fail silently, resulting in revoked user access not being enforced properly. Consequently, an authenticated user may continue to have unauthorized access to gRPC interfaces despite policy changes. The vulnerability affects specific versions of Arista EOS as listed, and was internally discovered with no current evidence of active exploitation.

The vulnerability can lead to unauthorized access persistence for users whose permissions were revoked by a policy update, potentially allowing continued access to gRPC interfaces. This impacts the integrity of access control but does not affect confidentiality or availability. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Arista Networks advisories for updates. Until a fix is available, consider limiting the configuration of multiple gNSI transports if feasible and review access policies carefully.