EUVD-2026-80388
GHSA-738x-gmrv-v9j5
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-adjacent unauthenticated (AV:A/PR:N), low complexity to send malformed PIM messages, availability-only crash of the Pimsm agent so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
3DescriptionCVE.org
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
AnalysisAI
Malformed PIM Sparse Mode messages can crash the Pimsm agent on Arista EOS switches, causing a sustained denial of service when an unauthenticated, network-adjacent attacker repeatedly sends the triggering traffic. Exploitation is constrained to devices where both PIM Sparse Mode and MLAG are configured simultaneously - a non-default combination, and the attacker must be Layer-2 adjacent rather than Internet-reachable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Arista EOS switch to have BOTH PIM Sparse Mode AND MLAG (Multi-Chassis Link Aggregation) configured - this is a non-default combination, not a stock configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability-only issue, not a high-urgency crisis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the first action is to consult Arista Security Advisory 0177 (https://www.arista.com/en/support/advisories-notices/security-advisory/24733-security-advisory-0177) for the fixed EOS release train and upgrade guidance, then schedule an upgrade to that release on any switch matching the exposure profile. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today