CVE-2026-7473mediumunder attackCWE-1023

CVE-2026-7473: medium-severity vulnerability in Arista Networks EOS

Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

Published · Updated

Follow this CVE+ Monitor EOS+ Monitor Extensible Operating System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 6.9epss 1.1%
from disclosure to weapon5 days
Published on NVDJun 5
1st PoC+5d
CISA KEV+4d
Action required by CISAfederal deadline: 2026-06-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Arista EOS switches with tunnel decapsulation configured (VXLAN, GRE, etc.) can incorrectly unpack and forward packets that weren't meant for them if the destination IP matches the tunnel's IP, because the switch doesn't check the tunnel protocol type. An attacker could exploit this to bypass network security controls or redirect traffic.

Technical detail

The vulnerability exists in Arista EOS tunnel decapsulation processing where the switch fails to validate the tunnel protocol type before decapsulation. An attacker can craft packets with a destination IP matching the configured tunnel interface but using a different protocol, causing the switch to incorrectly decapsulate and forward them. This leads to bypassing intended tunnel routing policies and potential traffic redirection.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected products
Arista Networks · EOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Arista Networks EOS

In the same product, most dangerous first.

CVE-2024-27890HIGHOn affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).EPSS 4.4%CVE-2021-28506CRITICALAn issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.EPSS 1.5%CVE-2021-28510MEDIUMFor certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.EPSS 1.0%CVE-2021-28505HIGHOn affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.EPSS 0.9%CVE-2023-24511MEDIUMOn affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.EPSS 0.8%CVE-2023-24545HIGHOn affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch.EPSS 0.8%