EUVD-2026-80328
GHSA-x3fc-rhxr-g7jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain L2 presence on OSPFv2 broadcast segment
-
DeliveryCraft malicious OSPFv2 packet bypassing auth
-
ExploitInject packet to peer routers
-
ExecutionTrigger adjacency flapping and packet loss
-
ImpactRouting disruption across OSPF domain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Requires: (1) affected Arista EOS running OSPFv2 as a configured routing protocol, (2) OSPFv2 authentication configured on the segment (the flaw lets a crafted packet be accepted despite it - CWE-345), and (3) the attacker positioned on the same OSPFv2 broadcast segment as the victim routers (adjacent/L2 access, AV:A). Limiting factors: no exploitation is possible against devices not running OSPFv2; the attacker cannot exploit remotely across L3 (must be link-local on the broadcast domain); impact is confined to availability (adjacency flapping, packet loss, and broader OSPF-domain routing disruption) with no confidentiality or integrity impact. Authentication is not required of the attacker (PR:N). |
| Impact | This is a genuine availability/denial-of-service issue, not a data-exposure or takeover flaw, despite the misleading 'Information Disclosure' tag. The vendor CVSS 4.0 vector (7.0, AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H) is well-calibrated: it is availability-only (VC:N/VI:N), adjacent-only (AV:A - the attacker must sit on the same OSPFv2 broadcast segment), carries an explicit attack requirement (AT:P, reflecting that OSPFv2 authentication must be configured and CWE-345 insufficient authenticity verification allows the crafted packet to be accepted), and records impact to subsequent systems (SA:H - routing disruption propagates across the broader OSPF domain). Exploitation status: no public exploit identified at time of analysis - not in CISA KEV, no POC signal, and Arista self-reported the defect. EPSS is not provided. The adjacency requirement is the dominant real-world limiter: an attacker already needs L2 presence on a routed broadcast segment, which typically means an insider, a compromised adjacent device, or physical/VLAN access. Net: real but bounded priority - patch on OSPFv2-speaking Arista devices, but this is not an internet-facing, mass-exploitable condition. Note conflict to verify: the tag set marks this 'Information Disclosure' while the CVSS vector shows zero confidentiality/integrity impact - treat the tag as wrong, not the vector. |
| Exploit ScenarioDerived | An attacker with a foothold on a broadcast segment where Arista EOS routers exchange OSPFv2 (e.g. a compromised host or rogue device on a routed VLAN) sends a specially crafted OSPFv2 packet even though OSPFv2 authentication is configured. This causes OSPF adjacencies to flap and packets to drop, and the routing instability spreads across the wider OSPF domain, degrading connectivity. No public exploit code is identified at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Crafted OSPFv2 packets sent by an unauthenticated attacker on the same broadcast segment can force adjacency flapping, packet loss, and wider routing disruption on Arista EOS switches and routers that have OSPFv2 configured together with OSPFv2 authentication. Affected maintenance trains identified in EUVD are EOS below 4.33.0F and the 4.33.x (through 4.33.9M), 4.34.x (through 4.34.7M), 4.35.x (through 4.35.5M), and 4.36.x (through 4.36.1F) branches; the CVSS 4.0 base score is 7.0 (AV:A/AC:L/AT:P/PR:N/UI:N, VC:N/VI:N/VA:H/SC:N/SI:N/SA:H), and our independent 3.1 assessment scores it AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H, so the impact is strictly availability - no confidentiality or integrity loss - and the 'Information Disclosure' tag attached to this record is misleading. No CISA KEV listing is present and no public exploit code has been identified at time of analysis; authentication requirements are unauthenticated per the PR:N vector, with the compensating prerequisite being adjacency to the OSPFv2 segment rather than any credential.
Earlier versions of this analysis (1)
OSPFv2 adjacency flapping and domain-wide routing disruption in Arista EOS can be triggered by a specially crafted OSPFv2 packet sent by an unauthenticated attacker who is positioned on the same Layer-2 broadcast segment as an affected switch, even when OSPFv2 authentication is configured. The flaw carries a vendor CVSS of 8.2 (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) and affects EOS platforms with OSPFv2 enabled; because the vector is Adjacent rather than Network, the practical risk is materially lower than the raw score implies, being confined to networks where untrusted hosts share an OSPF broadcast segment. Impact is limited to routing availability and integrity - neighbor churn, packet loss, and possible propagation of disruption into the wider OSPF domain - with no confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Patch status is 'Patch available per vendor advisory' - Arista has published Security Advisory 0171 (https://www.arista.com/en/support/advisories-notices/security-advisory/24727-security-advisory-0171) with fixed EOS releases for the affected 4.33.x, 4.34.x, 4.35.x, and 4.36.x trains; consult that advisory for the exact fixed build for your maintenance train, since the input data does not independently confirm a specific fix version string. Until the upgrade is completed, treat the OSPFv2 broadcast segment as the trust boundary it now is: restrict physical and L2 access to it (802.1X, port security, disabling unused ports, and DHCP snooping with dynamic ARP inspection to blunt host impersonation), and disable OSPFv2 on any interface that does not need to form adjacencies, accepting that this changes topology design where passive interfaces were previously used for prefix advertisement. An inbound ACL filtering IP protocol 89 on access-facing ports can limit spoofed OSPF packets, with the trade-off that the filter must explicitly permit each legitimate neighbor address or it will break adjacency formation itself. Because OSPFv2 authentication is a prerequisite for this specific bypass (the flaw defeats the check rather than relying on its absence), enabling or rotating authentication keys is not a mitigation for this CVE, although it remains good practice against other OSPF threats. Finally, enable adjacency and syslog alerting on OSPF neighbor state changes so that flapping is detected quickly and affected routers can be isolated from the segment while the upgrade is staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OSPFv2 is a link-state interior gateway protocol carried directly over IP protocol 89 and using the multicast groups 224.0.0.5 (AllSPFDrouters) and 224.0.0.6 (AllDRouters). Neighbor routers form adjacencies through Hello exchange and then synchronize link-state databases via LSAs; any instability in that exchange causes SPF recalculation, route churn, and transient forwarding gaps. OSPFv2 supports authentication fields (plaintext, MD5, and SHA-HMAC keyed digests) intended to ensure that only trusted routers participate in the segment. CWE-345 (Insufficient Verification of Data Authenticity) is the root-cause class here: on affected EOS builds, a specially crafted OSPFv2 packet is accepted even when OSPFv2 authentication is configured, meaning the authentication check can be bypassed rather than that no authentication exists. Because the attacker must already reside on the same broadcast domain (AV:A) and the target must be running OSPFv2 with authentication enabled (Attack Requirements: Present in the CVSS 4.0 vector), this is not remotely exploitable across L3. The CVSS 4.0 metrics SA:H (subsequent availability impact High) and the 3.1 assessment's S:C (scope change) both reflect the fact that the disruption propagates beyond the directly attacked device into the broader OSPF domain through LSA flooding and reconvergence, whereas confidentiality and integrity impacts are absent (VC:N/VI:N/SC:N/SI:N). The CPE entry cpe:2.3:a:arista_networks:eos:*:*:*:*:*:*:*:* carries a wildcard version, so exact version mapping comes from the EUVD range data rather than the CPE string.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Adjacent broadcast-segment access (AV:A); AC:H reflects the OSPFv2-authentication-configured attack requirement (4.0 AT:P); S:C as routing disruption spreads beyond the target; availability-only (A:H).
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
Executive ViewAI
Arista EOS switches and routers configured with OSPFv2 and OSPFv2 authentication are exposed to a high-severity availability vulnerability (CVE-2026-73435) that an unauthenticated attacker on the same broadcast segment can use to cause adjacency flapping, packet loss, and broader routing disruption. The impact is limited to availability, but it can affect production, data center, or WAN connectivity where these devices provide critical routing, so leadership should prioritize remediation of affected maintenance trains. No public exploit identified at time of analysis, and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB