EUVD-2026-80329
GHSA-j872-p7vg-jj85
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent OSPF neighbor position
-
DeliveryCraft malformed OSPFv2 segment-routing packet
-
ExploitSend to target EOS neighbor
-
ExecutionTrigger input-validation fault
-
PersistOSPF process restarts
-
ImpactRouting disruption / traffic loss
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | Requires the target Arista EOS device to have BOTH OSPFv2 and OSPFv2 segment routing configured - segment routing is not a default OSPF setting, so this excludes deployments running plain OSPFv2 or no dynamic routing. The attacker must be an adjacent OSPF neighbor (CVSS AV:A): positioned on the same routing segment / link as the victim and able to send OSPFv2 packets it will process, which typically means a compromised or rogue device within the OSPF domain rather than an arbitrary internet host. No authentication (PR:N) or user interaction (UI:N) is needed once adjacency is achievable. Limiting factors: non-default segment-routing configuration, adjacency/L2 reachability requirement, and availability-only impact (no data compromise); repeated packets are needed to sustain outage since impact is a process restart. |
| Impact | This is a moderate-severity, availability-only denial-of-service issue, not a critical breach vector. The vendor CVSS of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: the attack is adjacent-only (AV:A) rather than remotely routable, and impact is confined to availability (C:N/I:N/A:H) - a crafted OSPFv2 packet causes the OSPF process to restart, disrupting routing convergence but not disclosing or altering data. Although PR:N marks it as unauthenticated, exploitation realistically requires the attacker to be an adjacent OSPF neighbor on a segment where OSPFv2 and OSPFv2 segment routing are configured, which is a meaningful practical gate. No EPSS score, KEV listing, or public PoC is present in the supplied data, so there is no evidence of active exploitation or automation - treat this as a patch-in-normal-cycle item for networks running OSPF segment routing, not an emergency. Note a metadata conflict: the 'Information Disclosure' tag directly contradicts the CVSS vector (C:N), and CWE-1284 (improper validation of specified quantity in input) plus the description confirm this is a DoS, not a disclosure. The affected-product tags also lack the 'arista' vendor tag. |
| Exploit ScenarioDerived | An attacker with a foothold on a network segment adjacent to an Arista EOS device - for example a compromised router, a rogue device on a routing LAN, or a malicious OSPF peer - sends a specially crafted OSPFv2 packet to a neighbor that has OSPFv2 segment routing configured. The malformed field triggers improper input validation and the OSPF process restarts, causing routing adjacencies to drop and traffic disruption during reconvergence, repeatable to sustain an outage. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
A crafted OSPFv2 packet delivered by an adjacent OSPF neighbor can force an unexpected restart of the OSPF process on Arista EOS devices that run both OSPFv2 and OSPFv2 segment routing, producing an availability-only denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only deployments with segment routing enabled under OSPF are exposed, since this is not a default OSPF setting, and the attacker must already be positioned on the same routing segment or link (typically a compromised or rogue device inside the OSPF domain) rather than an arbitrary internet host. No authentication or user interaction is required once adjacency is achievable, repeated packets can sustain the outage, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
Vendor guidance is published in Arista Security Advisory 0171 (https://www.arista.com/en/support/advisories-notices/security-advisory/24727-security-advisory-0171), which should be consulted for the exact fixed EOS releases and upgrade path; no specific fixed version number is provided in the available data, so treat the advisory as the source of truth and upgrade to the recommended maintenance release for the affected platform. Where an immediate upgrade is not possible, the most effective compensating control is to remove OSPFv2 segment routing from the running configuration (or migrate the affected prefixes to a non-SR IGP), which eliminates the vulnerable parsing path entirely but forfeits the SR-MPLS traffic-engineering benefits and requires a planned change window. Enabling OSPF authentication (MD5/SHA) and filtering IP protocol 89 on all ports facing untrusted Layer 2 segments raises the bar against rogue devices forming adjacency, but carries the trade-off of a coordinated key rollout and does not protect against a compromised neighbor that already holds valid credentials; port-level ACLs and disabling OSPF on access-facing interfaces are similarly useful but must be validated against legitimate topology requirements. Because the impact is a recoverable process restart that must be sustained with repeated packets, monitoring for OSPF adjacency flaps and unexpected routing-process resets provides a practical detection control while patching is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OSPFv2 segment routing (RFC 8665) extends the OSPFv2 link-state protocol with new opaque LSA carrying prefix-SID and adjacency-SID sub-TLVs, which the OSPF process must parse from LSAs flooded by adjacent neighbors. CWE-1284 (Improper Validation of Specified Quantity in Input) points to a length, count, or SID-index field inside one of these TLVs being trusted without adequate bounds validation, so a malformed packet from a legitimate-looking neighbor drives the parser into an invalid state and triggers an unexpected OSPF process restart. The root cause is therefore a protocol-parser input-validation defect in the segment-routing code path rather than a memory-safety escalation: the assessed vector shows no confidentiality or integrity impact (C:N/I:N), with the sole consequence being loss of availability (A:H) while the OSPF process recovers and reconverges. The supplied CPE (cpe:2.3:a:arista_networks:eos:*:*:*:*:*:*:*:*) is version-agnostic, indicating the vendor advisory covers EOS releases broadly; the affected configuration surface is narrowly defined by the coexistence of OSPFv2 and OSPFv2 segment routing. Note that the accompanying tag labels the issue 'Information Disclosure', which conflicts with the assessed C:N rating and should be treated as a tagging artifact rather than an indicator of data exposure.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent OSPF neighbor required (AV:A), no auth or interaction, config-gated but not per-attempt (AC:L), and impact is process restart affecting availability only (C:N/I:N/A:H); agrees with vendor.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
3DescriptionCVE.org
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB