EUVD-2026-80328
GHSA-x3fc-rhxr-g7jr
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent broadcast-segment access (AV:A); AC:H reflects the OSPFv2-authentication-configured attack requirement (4.0 AT:P); S:C as routing disruption spreads beyond the target; availability-only (A:H).
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
6DescriptionCVE.org
On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
AnalysisAI
Crafted OSPFv2 packets sent by an unauthenticated attacker on the same broadcast segment can force adjacency flapping, packet loss, and wider routing disruption on Arista EOS switches and routers that have OSPFv2 configured together with OSPFv2 authentication. Affected maintenance trains identified in EUVD are EOS below 4.33.0F and the 4.33.x (through 4.33.9M), 4.34.x (through 4.34.7M), 4.35.x (through 4.35.5M), and 4.36.x (through 4.36.1F) branches; the CVSS 4.0 base score is 7.0 (AV:A/AC:L/AT:P/PR:N/UI:N, VC:N/VI:N/VA:H/SC:N/SI:N/SA:H), and our independent 3.1 assessment scores it AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H, so the impact is strictly availability - no confidentiality or integrity loss - and the 'Information Disclosure' tag attached to this record is misleading. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires: (1) affected Arista EOS running OSPFv2 as a configured routing protocol, (2) OSPFv2 authentication configured on the segment (the flaw lets a crafted packet be accepted despite it - CWE-345), and (3) the attacker positioned on the same OSPFv2 broadcast segment as the victim routers (adjacent/L2 access, AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine availability/denial-of-service issue, not a data-exposure or takeover flaw, despite the misleading 'Information Disclosure' tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is 'Patch available per vendor advisory' - Arista has published Security Advisory 0171 (https://www.arista.com/en/support/advisories-notices/security-advisory/24727-security-advisory-0171) with fixed EOS releases for the affected 4.33.x, 4.34.x, 4.35.x, and 4.36.x trains; consult that advisory for the exact fixed build for your maintenance train, since the input data does not independently confirm a specific fix version string. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arista EOS switches and routers and identify any running OSPFv2 together with OSPFv2 authentication on affected releases: EOS below 4.33.0F; 4.33.x through 4.33.9M; 4.34.x through 4.34.7M; 4.35.x through 4.35.5M; and 4.36.x through 4.36.1F; apply the vendor patch per the Arista advisory or, if patching must be staged, isolate critical OSPF broadcast domains and enable enhanced OSPF adjacency and logging alerts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today