CVE-2026-7473
5.8 MEDIUMOn affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups,...
Published: 2026-06-05 · Last updated: 2026-06-09
Severity and scoring
- CVSS
- 5.8 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
- CWE
- CWE-1023
Affected products
| Vendor | Product |
|---|---|
| arista | eos |
Description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-7473
- [Other]https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137
- [Vendor advisory]https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137
- [Other]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473
Related CVEs
Same vendor
- CVE-2026-25624 — An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Manage... (5.7 MEDIUM)
- CVE-2026-25623 — An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista N... (6.0 MEDIUM)
- CVE-2026-25622 — A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall... (6.0 MEDIUM)
- CVE-2026-25621 — A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due t... (6.0 MEDIUM)
- CVE-2026-25620 — An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management... (6.0 MEDIUM)
Same CWE
- CVE-2026-48587 — An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6 (3.1 LOW)