CVE-2026-73437
CriticalCVSS 9.6Summary
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source.
Risk Assessment
The attacker can supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients. This may compromise communication confidentiality and network availability.
Recommendation
Apply the vendor patch for Arista EOS. Until patched, consider disabling DHCP relay or implementing additional filtering of DHCP packet sources.
Other vulnerabilities in Arista EOS
See all- CVE-2015-8236High
Arista EOS versions before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allow remote attackers to execute arbitrary code as root by leveraging management-plane access.
- CVE-2026-7473MediumActively exploited
On affected platforms running Arista EOS, a tunnel decapsulation configuration, such as VXLAN, decap-groups, or a GRE tunnel interface, may lead to incorrect decapsulation and forwarding of other unexpected tunneled packets. This issue arises from the switch's failure to verify the tunnel protocol type.
- CVE-2024-27892Critical
On platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
- CVE-2024-27890Critical
Platforms running Arista EOS with OpenConfig configured may accept gNMI Set requests that should have been rejected, leading to unexpected configuration changes on the switch.
- CVE-2026-73449Medium
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.
- CVE-2025-8873High
Vulnerability in Arista EOS with IPsec configured. A specially crafted packet can stop all IPsec traffic processing in the dataplane. After reset, traffic may not resume. Non-IPsec traffic is unaffected.
- CVE-2024-27891Medium
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
- CVE-2023-5502Medium
On platforms running Arista EOS with 802.1x authentication configured on access/trunk ports and routing enabled on the access VLAN, a malicious supplicant may bypass the requirement to perform 802.1x authentication.
- CVE-2024-6858Medium
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
- CVE-2023-3646Medium
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.
Original NVD description (English source)
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.