EUVD-2026-81010Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent VLAN access (AV:A), unauthenticated and low-complexity against default IGMP snooping (PR:N/AC:L), pure availability impact on multicast forwarding (C:N/I:N/A:H).
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
Lifecycle Timeline
4DescriptionCVE.org
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.
AnalysisAI
Malformed IGMP packets sent by a network-adjacent, unauthenticated attacker can terminate the IGMP snooping agent on Arista EOS switches, causing multicast traffic to flood to all ports of the affected VLAN until the agent recovers. Because IGMP snooping is enabled by default on all VLANs in EOS, most deployments are exposed out of the box, but the attacker needs Layer 2 adjacency to a target VLAN (a compromised host, rogue device, or insider on the switched segment) rather than arbitrary internet reachability, and the impact is a bounded, self-recovering availability disruption that must be repeatedly triggered to be prolonged. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires IGMP snooping to be active on the target VLAN, which per the description is enabled by DEFAULT on all VLANs in Arista EOS - so most deployments are affected out of the box. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk, not a critical priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not confirmed from the available input data - no fixed EOS version, commit, or PR was supplied - so the immediate action is to consult Arista Security Advisory 0159 (https://www.arista.com/en/support/advisories-notices/security-advisory/24715-security-advisory-0159) and apply the vendor-designated EOS upgrade for the affected release train as soon as it is published; do not assume any specific version number that is not stated in that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Arista EOS switches and identify which VLANs have IGMP snooping enabled and which actually carry business-critical multicast; on VLANs with no multicast requirement, disable IGMP snooping as the fastest risk reduction, and on all access ports disable unused ports, enable port security and storm control, and restrict VLAN trunking to trusted uplinks to shrink the Layer 2 adjacency an attacker needs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly oth
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential d
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today