CVE-2026-7473

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-7473
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

5.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137 Broken Link
https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 Mitigation Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473 US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
OR cpe:2.3:h:arista:7020sr-24c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020sr-32c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020srg-24c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020tr-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020tra-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2a-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2a-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2k-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2k-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2m-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-32d4:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-32p4:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-36s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-96:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3mk-32d4s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3mk-32p4s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3-24:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3a-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3a-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3ak-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3ak-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3am-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3am-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280pr3-24:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c36-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qra-c36s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qra-c36sm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2-48yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2-48yc6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2a-48yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2a-48yc6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2k-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3-40yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3-48yc8:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3m-48yc8:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sra-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sra-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sram-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280srm-40cx2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tr-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tr3-40c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tra-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tra-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3a-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3ak-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3am-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-36q-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-48s2cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-8cfpx-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2a-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2ak-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2ak-48ycq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2am-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2m-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-24d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-24p:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-36cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3k-36cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3k-48y4d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500rm-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7504r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7508r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7512r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516-sup2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516n-ch:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3-36d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3-48cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36dm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36p:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36pm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3ak-36dm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3ak-36pm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-48cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-48cqms:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-72y:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7816lr3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:*
History

25 Oct 2026, 23:10

Type Values Removed Values Added
Summary
  • (es) En plataformas afectadas que ejecutan Arista EOS donde una configuración de desencapsulación de túnel -como VXLAN (Virtual Extensible LAN), decap-groups, o una interfaz de túnel GRE (Generic Routing Encapsulation)- está presente, el switch desencapsulará y reenviará incorrectamente otros paquetes tunelizados inesperados con una IP de destino que coincida con su IP de desencapsulación configurada. Esto ocurre porque el switch no verifica el tipo de protocolo de túnel, lo que podría llevar al procesamiento inesperado de tráfico de túnel no configurado. Se ha informado que este problema está siendo explotado en la naturaleza.
Information

Published : 2026-06-05 17:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-7473

Mitre link : CVE-2026-7473

CVE.ORG link : CVE-2026-7473

JSON object : View

Products Affected

arista

  • eos
  • 7280cr3am-48d6
  • 7280cr3am-72
  • 7289r3a-sc
  • 7280cr2k-60
  • 7280cr3-36s
  • 7808r3
  • 7800r3ak-36pm
  • 7280qr-c36
  • 7280cr3ak-72
  • 7500r2m-36cq-lc
  • 7500r3-24p
  • 7280sr2a-48yc6
  • 7800r3k-48cq
  • 7289r3ak-sc
  • 7280cr3mk-32d4s
  • 7516r-fm
  • 7280qr-c72
  • 7280cr3-96
  • 7280cr2m-30
  • 7800r3ak-36dm
  • 7280sra-48c6
  • 7812r3
  • 7280cr3a-48d6
  • 7280sra-48c6-m
  • 7800r3-48cq
  • 7500r-36q-lc
  • 7020tr-48
  • 7280dr3ak-36
  • 7280qr-c36-m
  • 7280cr2a-30
  • 7500r2ak-36cq-lc
  • 7504r-fm
  • 7280cr3ak-24d12
  • 7280sr2k-48c6-m
  • 7500r2-36cq-lc
  • 7508r3
  • 7516n-ch
  • 7500r2ak-48ycq-lc
  • 7280cr3a-72
  • 7280cr3am-24d12
  • 7280dr3ak-54
  • 7280tr3-40c6
  • 7816r3
  • 7020srg-24c2
  • 7280cr2-60
  • 7500r-36cq-lc
  • 7500r3k-36cq
  • 7280sr3-48yc8
  • 7508r-fm
  • 7500r-48s2cq-lc
  • 7280sr-48c6
  • 7800r3k-48cqms
  • 7280sr3m-48yc8
  • 7280cr-48
  • 7500r2am-36cq-lc
  • 7280dr3a-54
  • 7280qra-c36s
  • 7280sr2-48yc6-m
  • 7280cr2k-30
  • 7504r3
  • 7280cr3-32d4
  • 7800r3a-36pm
  • 7280cr3a-24d12
  • 7512r-fm
  • 7280dr3a-36
  • 7280cr2a-60
  • 7020sr-32c2
  • 7280tra-48c6-m
  • 7800r3a-36p
  • 7500r-8cfpx-lc
  • 7800r3a-36dm
  • 7280sram-48c6
  • 7280cr3ak-48d6
  • 7816lr3
  • 7020tra-48
  • 7516-sup2
  • 7800r3a-36d
  • 7280tr-48c6
  • 7020sr-24c2
  • 7500r2a-36cq-lc
  • 7280dr3am-54
  • 7280pr3-24
  • 7280tra-48c6
  • 7500rm-36cq-lc
  • 7500r3-36cq
  • 7280qra-c36sm
  • 7280cr3-32p4
  • 7280srm-40cx2
  • 7804r3
  • 7280dr3am-36
  • 7289r3am-sc
  • 7280sr3-40yc6
  • 7800r3k-72y
  • 7280sr2-48yc6
  • 7280sr2a-48yc6-m
  • 7280cr3mk-32p4s
  • 7500r3-24d
  • 7800r3-36d
  • 7512r3
  • 7280dr3-24
  • 7500r3k-48y4d
CWE
CWE-1023

Incomplete Comparison with Missing Factors