EUVD-2026-80388
GHSA-738x-gmrv-v9j5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network-adjacent position to switch
-
DeliveryCraft malformed PIM-SM messages
-
ExploitSend to Pimsm agent repeatedly
-
ExecutionCrash and restart Pimsm continuously
-
ImpactSustained multicast routing denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the target Arista EOS switch to have BOTH PIM Sparse Mode AND MLAG (Multi-Chassis Link Aggregation) configured - this is a non-default combination, not a stock configuration. The attacker must be unauthenticated but network-adjacent (AV:A), i.e., positioned on a directly connected/Layer-2-adjacent segment able to send PIM messages to the device, not reachable from the general Internet. Attack Requirements are Present (AT:P), meaning a specific condition beyond mere reachability (the malformed-message crash path plus repeated delivery to sustain the outage) must be met. Impact is limited to availability of the Pimsm agent / multicast routing; there is no confidentiality or integrity impact, and the agent auto-restarts, so a single message causes only a brief interruption - sustained denial of service requires continuous repeated attacks. |
| Impact | This is a genuine but bounded availability-only issue, not a high-urgency crisis. The vendor CVSS 4.0 score of 6.0 (Medium) is well-calibrated and consistent with the description: the vector AV:A/AC:L/AT:P/PR:N/UI:N with VA:H/SA:L captures an unauthenticated but network-adjacent (Layer-2/adjacent) attacker causing a Pimsm agent crash, with only availability impact (VC:N/VI:N). The AT:P (Attack Requirements: Present) metric and the description together confirm exploitation is gated on a specific non-default deployment: the target device must have BOTH PIM Sparse Mode AND MLAG configured. No EPSS score, KEV listing, or POC is provided in the input; per precision rules this is 'no public exploit identified at time of analysis.' Signals are internally consistent - there is no conflict between the network-adjacent CVSS vector and the description (both indicate adjacency, not remote-Internet reach, and not local access). The realistic priority is moderate: high-value where PIM-SM multicast routing over MLAG is in production (e.g., data-center fabrics), but the adjacency requirement and dual-feature config gate substantially limit the exploitable population. Treat as a patch-in-normal-cycle item rather than an emergency, prioritizing multicast-enabled MLAG switches. |
| Exploit ScenarioDerived | An attacker with a foothold on a network segment adjacent to an Arista EOS switch running PIM Sparse Mode with MLAG sends crafted malformed PIM messages to the device. The Pimsm agent parses the malformed input (CWE-20 improper input validation) and terminates; although EOS auto-restarts it, the attacker repeats the malformed traffic to force continuous restarts, producing a sustained denial of service against multicast routing. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Malformed PIM Sparse Mode messages can crash the Pimsm agent on Arista EOS switches, causing a sustained denial of service when an unauthenticated, network-adjacent attacker repeatedly sends the triggering traffic. Exploitation is constrained to devices where both PIM Sparse Mode and MLAG are configured simultaneously - a non-default combination, and the attacker must be Layer-2 adjacent rather than Internet-reachable. Impact is availability-only: the Pimsm agent auto-restarts, so a single malformed message causes only a brief multicast-routing interruption, while continuous repetition is required to keep the agent in a restart loop. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); risk is bounded rather than urgent.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to consult Arista Security Advisory 0177 (https://www.arista.com/en/support/advisories-notices/security-advisory/24733-security-advisory-0177) for the fixed EOS release train and upgrade guidance, then schedule an upgrade to that release on any switch matching the exposure profile. Where an immediate upgrade is not possible, compensate in layers with explicit trade-offs: if multicast routing is not operationally required on the box, disable PIM Sparse Mode - this fully removes the attack surface but eliminates multicast routing on that device; if MLAG is not required for dual-homing redundancy, removing it also breaks the precondition, at the cost of losing multi-chassis link redundancy and fast failover. Restrict who can be PIM-adjacent: apply control-plane/management ACLs or CoPP to permit IP protocol 103 (PIM) only from trusted multicast routers and distribution/leaf peers, and prevent PIM from being reachable on user-facing or untrusted VLANs - this narrows the AV:A population that can trigger the bug but requires accurate, maintained adjacency inventories to avoid breaking legitimate multicast peering. Segment or firewall Layer-2 adjacency toward untrusted segments where feasible (a design change, not a quick toggle). Finally, monitor and alert on repeated Pimsm agent restarts or process churn and on unexpected PIM neighbors via syslog/streaming telemetry so an active restart-loop attack is detected early; note this is detection, not prevention, and does not stop the availability impact while a determined adjacent attacker keeps sending malformed messages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an input-validation weakness (CWE-20) in the PIM Sparse Mode implementation (the Pimsm agent/process) of Arista EOS, tracked under Arista Security Advisory 0177. PIM Sparse Mode is a multicast routing protocol whose routers exchange Hello, Join/Prune, Register and Assert messages over IP protocol 103; the affected code path fails to safely handle certain malformed message content, terminating the agent rather than rejecting the packet. The precondition combination is what elevates this from a trivial crash to a configured-scenario issue: the device must run PIM Sparse Mode and also MLAG (Multi-Chassis Link Aggregation), which is a deliberate, non-default deployment pattern typical of multicast-enabled leaf/ToR fabrics. The assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the attacker needs adjacency on a directly connected or Layer-2-adjacent segment able to deliver PIM traffic to the switch - not general Internet reachability - with no authentication or user interaction, and with Attack Requirements present because both the malformed-message crash path and sustained repetition are needed for the full outage. Affected product identification is via the wildcard CPE cpe:2.3:a:arista_networks:eos:*:*:*:*:*:*:*:*, and the vendor advisory should be consulted for the precise patched and vulnerable release list, since no explicit version range was supplied with the source data. There is no confidentiality or integrity impact; only availability of the PIM Sparse Mode agent and therefore multicast routing is at risk.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Network-adjacent unauthenticated (AV:A/PR:N), low complexity to send malformed PIM messages, availability-only crash of the Pimsm agent so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
2DescriptionCVE.org
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB