CVE-2026-73443
MediumCVSS 4.7Summary
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down.
Risk Assessment
This can result in a denial of service for hosts using the virtual gateway address, as traffic may not fail over to the backup router. Organizations relying on VRRP for gateway high availability may experience extended network unavailability.
Recommendation
Consider implementing anti-replay protections for VRRPv2, such as using VRRPv3 or additional authentication mechanisms, and monitor network segments for repeated VRRP advertisements. Also track vendor updates from Arista regarding this issue.
Other vulnerabilities in Arista EOS
See all- CVE-2026-73462Medium
On affected platforms running Arista EOS with IGMP snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers.
- CVE-2026-73457Medium
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.
- CVE-2026-73442Low
On Arista EOS platforms with VRRP enabled, peer device VRRP authentication credentials are logged in cleartext. An authenticated user with sufficient privileges can read these credentials from agent trace logs or from a system receiving forwarded log output, without access to the network segment running VRRP.
- CVE-2026-77190Medium
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The agent is automatically restarted, but repeated attacks can cause continuous restarts and a sustained denial of service.
- CVE-2015-8236High
Arista EOS versions before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allow remote attackers to execute arbitrary code as root by leveraging management-plane access.
- CVE-2026-73456Critical
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
- CVE-2026-86106Critical
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
- CVE-2026-73453Critical
An unauthenticated P4Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. By crafting a malicious packet during session initiation, an attacker can obtain complete administrative control over the switch.
- CVE-2026-73447Critical
A privileged attacker can exploit gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.
- CVE-2026-73437Critical
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source.
Original NVD description (English source)
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.