CVE-2026-7473

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-7473
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

5.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137 Broken Link
https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 Mitigation Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473 US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
OR cpe:2.3:h:arista:7020sr-24c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020sr-32c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020srg-24c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020tr-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020tra-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2a-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2a-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2k-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2k-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2m-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-32d4:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-32p4:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-36s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-96:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3mk-32d4s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3mk-32p4s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3-24:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3a-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3a-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3ak-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3ak-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3am-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3am-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280pr3-24:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c36-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qra-c36s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qra-c36sm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2-48yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2-48yc6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2a-48yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2a-48yc6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2k-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3-40yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3-48yc8:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3m-48yc8:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sra-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sra-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sram-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280srm-40cx2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tr-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tr3-40c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tra-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tra-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3a-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3ak-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3am-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-36q-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-48s2cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-8cfpx-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2a-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2ak-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2ak-48ycq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2am-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2m-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-24d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-24p:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-36cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3k-36cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3k-48y4d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500rm-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7504r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7508r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7512r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516-sup2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516n-ch:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3-36d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3-48cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36dm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36p:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36pm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3ak-36dm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3ak-36pm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-48cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-48cqms:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-72y:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7816lr3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2026-06-05 17:17

Updated : 2026-06-17 11:02

NVD link : CVE-2026-7473

Mitre link : CVE-2026-7473

CVE.ORG link : CVE-2026-7473

JSON object : View

Products Affected

arista

  • 7816r3
  • 7280tra-48c6
  • 7280tr3-40c6
  • 7280sra-48c6
  • 7280cr3-32d4
  • 7504r-fm
  • 7280sr2k-48c6-m
  • 7280cr3mk-32d4s
  • 7020tr-48
  • 7800r3k-72y
  • 7280cr3mk-32p4s
  • 7280cr-48
  • 7808r3
  • 7500r3k-48y4d
  • 7280cr3am-24d12
  • 7812r3
  • 7508r-fm
  • 7500r2-36cq-lc
  • 7280sr3-40yc6
  • 7500r-36cq-lc
  • 7280dr3ak-36
  • 7280srm-40cx2
  • 7512r-fm
  • 7816lr3
  • 7800r3ak-36dm
  • 7280sr2a-48yc6
  • 7500r2a-36cq-lc
  • 7500r2m-36cq-lc
  • 7500r-48s2cq-lc
  • 7280sr3-48yc8
  • 7280cr3ak-48d6
  • 7280sra-48c6-m
  • 7280sr-48c6
  • 7508r3
  • 7280qra-c36s
  • 7020sr-32c2
  • 7800r3k-48cq
  • 7280cr3a-48d6
  • 7800r3a-36d
  • 7800r3-48cq
  • 7280sram-48c6
  • 7280tra-48c6-m
  • 7020tra-48
  • 7280cr3-96
  • 7280cr3ak-72
  • 7804r3
  • 7800r3-36d
  • 7020sr-24c2
  • 7280dr3am-54
  • 7289r3am-sc
  • 7280sr2-48yc6-m
  • 7500r3-24d
  • 7280cr3ak-24d12
  • 7280qra-c36sm
  • 7289r3ak-sc
  • 7516n-ch
  • 7516-sup2
  • 7500r-36q-lc
  • 7500rm-36cq-lc
  • 7800r3a-36dm
  • 7280dr3-24
  • 7280qr-c36
  • 7280sr2a-48yc6-m
  • 7280dr3a-36
  • 7280qr-c72
  • 7280tr-48c6
  • 7500r2ak-48ycq-lc
  • 7280cr3a-24d12
  • 7280cr2a-60
  • 7280sr2-48yc6
  • 7280cr2m-30
  • 7504r3
  • 7280cr3-32p4
  • 7500r3-36cq
  • 7516r-fm
  • 7500r2am-36cq-lc
  • 7280cr3am-72
  • 7280cr2a-30
  • 7280dr3ak-54
  • 7800r3k-48cqms
  • 7280cr3a-72
  • 7280dr3a-54
  • 7800r3a-36p
  • 7280qr-c36-m
  • 7500r3k-36cq
  • 7280sr3m-48yc8
  • 7289r3a-sc
  • eos
  • 7280cr2k-60
  • 7500r3-24p
  • 7280cr3am-48d6
  • 7800r3ak-36pm
  • 7500r-8cfpx-lc
  • 7280pr3-24
  • 7280dr3am-36
  • 7280cr2k-30
  • 7020srg-24c2
  • 7500r2ak-36cq-lc
  • 7280cr3-36s
  • 7280cr2-60
  • 7512r3
  • 7800r3a-36pm
CWE
CWE-1023

Incomplete Comparison with Missing Factors