EUVD-2026-80592
GHSA-x98h-73r2-4gwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold on L2 segment
-
DeliveryCraft malformed multicast-related packet
-
ExploitSend to affected EOS interface
-
ExecutionPremature multicast forwarding-state expiry
-
ImpactTemporary multicast traffic loss
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Always-incorrect control flow
|
| Exploitation Conditions | Requires the attacker to be positioned on the same L2/adjacent network segment as an affected interface (CVSS AV:A - not remotely routable), and requires that the affected EOS device has multicast forwarding actively configured on those interfaces (PIM/IGMP multicast routing must be in use for 'multicast forwarding state' to exist and be expirable). No authentication and no user interaction are needed (PR:N/UI:N). Limiting factors: network adjacency requirement sharply reduces the attacker population, the impact is temporary (traffic resumes once forwarding state is rebuilt), and devices not running multicast are unaffected - so this is not exploitable against a default non-multicast deployment. |
| Impact | This is an availability-only denial-of-service issue in Arista EOS, not the confidentiality problem its 'Information Disclosure' tag implies (the CVSS 4.0 vector confirms VC:N/VI:N with only VA:H, temporary multicast traffic loss). The vendor CVSS 4.0 base score is 7.1 with an ADJACENT attack vector (AV:A), meaning the attacker must be on the same L2 segment/broadcast domain as an affected interface - this is a significant real-world limiter versus a routable AV:N flaw and keeps blast radius local. There is no CISA KEV listing, no public POC, and no EPSS score in the provided data, so there is no evidence of active or imminent exploitation; the finding was Arista-reported (internal discovery) rather than field-observed. Net: a moderate, defense-in-depth-relevant issue that is real but not an emergency - exploitation requires network adjacency and, critically, that multicast forwarding (PIM/IGMP) is actually configured and running on the target interfaces, so most environments face limited practical risk. No signals conflict, but note the tag/impact mismatch flagged below. |
| Exploit ScenarioDerived | An attacker with a foothold on a directly-attached L2 segment (e.g., a compromised host or rogue device in the same broadcast domain) crafts and sends a specially-formed packet to an affected EOS interface. This prematurely expires the multicast forwarding state, causing multicast streams (video, market data, routing multicast) to drop for the affected period until state is rebuilt. No public exploit code is identified at time of analysis, and no authentication is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. Exploitation additionally requires that multicast forwarding (PIM/IGMP) is actively configured on the targeted interface - a default, non-multicast deployment is not exposed - and the disruption is transient, since traffic resumes once forwarding state is rebuilt. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Earlier versions of this analysis (1)
Temporary multicast traffic loss on Arista EOS devices can be triggered by a specially crafted packet sent from an adjacent Layer-2 segment, which forces premature expiry of multicast forwarding state on the affected interface. The issue affects EOS interfaces that are actively forwarding multicast (for example with PIM or IGMP snooping configured and state established); the attacker must be on the same Layer-2 broadcast/multicast domain as that interface, and no authentication or user interaction is required (AV:A/PR:N/UI:N). Impact is confined to availability of multicast traffic only, is self-recovering once forwarding state is re-established, and involves no confidentiality or integrity effect (C:N/I:N) - there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a bounded, moderate-severity availability issue rather than a remotely exploitable internet-facing flaw.
RemediationAI
No vendor-released patch version is identified in the provided data, so the primary action is to consult Arista Security Advisory 0175 (https://www.arista.com/en/support/advisories-notices/security-advisory/24731-security-advisory-0175) to determine which EOS release trains are affected and to upgrade to the fixed release Arista specifies for the relevant train; do not assume a version number that is not stated in that advisory. Until the upgrade can be staged, compensating controls should target the two prerequisites. First, deny the attacker Layer 2 adjacency to exposed interfaces: apply port security / MAC limiting, 802.1X authentication, and disable unused access ports on segments that face untrusted hosts, accepting that this adds operational overhead and can break unmanaged devices or downstream switches. Second, reduce the multicast attack surface by configuring PIM/IGMP boundaries or multicast boundary ACLs so that multicast control and data traffic from untrusted segments cannot reach the interface holding forwarding state, and by disabling multicast routing on interfaces where it is not required - the trade-off being that legitimate receivers behind those boundaries will lose multicast service. Rate-limiting IGMP and PIM control traffic on edge interfaces can blunt a flood-style trigger, but may drop legitimate PIM/IGMP registrations and slow normal multicast convergence if the threshold is set too low. Because the effect is temporary and state is rebuilt automatically, prioritize monitoring for abnormal multicast state churn and traffic loss over disruptive full shutdowns, and treat every control above as a stopgap rather than a substitute for the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Arista EOS multicast forwarding logic. Multicast routing builds and maintains state (typically (*,G) and (S,G) mroute entries populated and refreshed via PIM and IGMP) that determines whether multicast packets received on an interface are replicated and forwarded toward receivers. CVE-2026-73468 is classified as CWE-670 (Always-Incorrect Control Flow Implementation): the packet-handling path does not correctly govern the lifetime of that state, so a crafted packet can drive premature expiry of forwarding entries rather than being rejected or ignored. The consequence is a control-plane/forwarding-plane desynchronization in which valid multicast flows are dropped until the entries are re-established through normal PIM/IGMP signaling, producing temporary multicast traffic loss. The affected-product CPE - cpe:2.3:a:arista_networks:eos:* - uses a wildcard version, so no version boundaries are asserted by the feed data and the vendor advisory must define the exact affected and fixed trains. The CVSS 4.0 vector is AV:A/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, which means the attacker must be on the adjacent Layer 2 segment (AV:A, not remotely routable across the Internet), needs no credentials and no user interaction (PR:N/UI:N), and achieves only high availability impact, with a low subsequent-system availability effect; confidentiality and integrity are unaffected. Because AV:A and PR:N are explicitly present, exploitation is best characterized as unauthenticated but topologically constrained to an adjacent network segment.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Adjacent L2 vector (AV:A) with no auth or interaction; availability-only impact (A:H, temporary multicast loss) and no confidentiality or integrity effect.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
5DescriptionCVE.org
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
Executive ViewAI
A high-severity availability defect in Arista EOS allows an unauthenticated attacker on an adjacent Layer 2 segment to prematurely expire multicast forwarding state, causing temporary loss of multicast traffic on affected interfaces. Only environments with multicast forwarding (PIM/IGMP) actively configured on the targeted interface are exposed; default non-multicast deployments are not, and the disruption is transient because traffic resumes once forwarding state is rebuilt. Leadership should care because any business service carried over multicast - such as market data, media distribution, or routing protocol adjacencies - can suffer intermittent, attacker-triggerable outages in the affected network segments, though no public exploit code or confirmed active exploitation was identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: disable PIM/IGMP on interfaces and VLANs where multicast forwarding is not required; restrict Layer 2/adjacent access via port security, unused-port shutdown, DHCP snooping, and Dynamic ARP Inspection; apply multicast group ACLs, storm control, and rate limiting to limit crafted multicast control traffic; segment multicast-enabled segments from general access networks; and monitor for multicast state churn and interface flaps to detect triggering attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB