EUVD-2026-80587
GHSA-qpgp-r7c9-594m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
OSPFv3 is link-local, so AV:A is more honest than vendor AV:N; no auth needed (PR:N); crafted packet is low-complexity; impact is availability-only agent restart (C:N/I:N/A:H).
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
8DescriptionCVE.org
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
AnalysisAI
Crafted OSPFv3 packets can force an unexpected restart of the OSPFv3 routing agent on Arista EOS devices that have OSPFv3 configured, causing a transient loss of routing adjacencies and traffic disruption. The flaw is an availability-only denial of service (CWE-130 improper handling of length parameters) with no code execution, data disclosure, or persistence; no authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation depends on a preconditioned packet and, per our assessment, an attacker positioned on the same OSPFv3-participating link or adjacency domain rather than arbitrarily across the internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the affected Arista EOS device to have OSPFv3 explicitly configured - not a default state, which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an availability-only denial-of-service flaw (CWE-130, improper handling of length/count) in the OSPFv3 agent of Arista EOS: a crafted packet causes an unexpected agent restart. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified in the provided data at time of analysis; consult Arista Security Advisory 0173 (https://www.arista.com/en/support/advisories-notices/security-advisory/24729-security-advisory-0173) for the fixed EOS release and upgrade path, and treat the advisory as the authoritative source before deploying any version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Arista EOS devices have OSPFv3 configured by running the equivalent of 'show ipv6 ospf' across the fleet, and inventory the exact EOS versions in use against Arista Security Advisory 0173 to establish exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today