EUVD-2026-80658
GHSA-wggc-2fwv-g783
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish authenticated overlay peer relationship
-
DeliveryCraft malformed tunneled IP fragments
-
ExploitSend over VCMP tunnel to neighbor
-
ExecutionTrigger out-of-bounds write in reassembly
-
PersistProcess crashes and restarts
-
ImpactTemporary traffic disruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be an authenticated overlay neighbor that has successfully formed a VCMP-protocol peer relationship with the target VeloCloud Edge or Gateway; the description explicitly states unauthenticated internet hosts that cannot form an overlay peer relationship CANNOT trigger the vulnerable logic. The flaw is specific to the VeloCloud VCMP tunnel protocol and is reached only when processing tunneled IP fragments between such neighbors. Limiting factors: the required overlay peer trust (an established SD-WAN peer, i.e. a compromised or malicious Edge/Gateway), the high attack complexity of crafting the malformed fragments (AC:H), and the impact being confined to a temporary process restart with no code execution or data compromise. |
| Impact | This is a genuine but bounded availability issue, not a critical remote-code-execution priority. The CVSS 4.0 base score of 8.2 is driven entirely by VA:H (availability high) with VC:N/VI:N/VA:H - an out-of-bounds write (CWE-787) that crashes and restarts the affected process, causing transient traffic disruption, with NO confidentiality or integrity impact. Two signals substantially lower real-world risk and partly conflict with the raw score: (1) AC:H reflects that the malformed tunneled IP fragments are non-trivial to craft, and (2) although the vector encodes PR:N (unauthenticated), the description explicitly states the vulnerable logic is only reachable 'between authenticated overlay neighbors' and that unauthenticated internet hosts unable to form an overlay peer relationship CANNOT trigger it. That is a meaningful contradiction: the vector says PR:N but the prose describes a hard prerequisite that the attacker already be an established, authenticated overlay peer - effectively a privilege/trust condition that the CVSS 4.0 vector under-represents. No EPSS score, KEV listing, POC, or SSVC data is provided. Net assessment: real but not urgent - impact ceiling is temporary DoS, and exploitation is gated behind overlay peer trust, so this is a targeted-scenario/insider-or-compromised-peer risk rather than broad internet-facing exposure. |
| Exploit ScenarioDerived | An attacker who has already established or compromised a VeloCloud overlay peer (Edge or Gateway) sends specially crafted tunneled IP fragments over the VCMP tunnel protocol to a neighboring Edge or Gateway. The malformed fragments trigger an out-of-bounds write during reassembly, terminating and restarting the target process and causing a temporary interruption of tunneled traffic. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) makes reliable triggering non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.
Earlier versions of this analysis (1)
An out-of-bounds write (CWE-787) in Arista VeloCloud Edge and VeloCloud Gateway is reachable only when the device processes tunneled IP fragments arriving over an established VCMP overlay tunnel from an authenticated peer; an attacker must already hold a valid overlay neighbor position, so arbitrary internet hosts cannot trigger the vulnerable logic. Successful exploitation causes the affected process to terminate and restart, producing a temporary disruption of traffic - an availability-only impact with no confidentiality or integrity loss, which is why the issue scores a modest 5.9 with high attack complexity reflecting the difficulty of crafting a reliable fragment sequence from a legitimate peer. There is no indication of confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis. Anyone operating VeloCloud Edges or Gateways that terminate overlay tunnels from untrusted or semi-trusted partners should treat this as a stability and DoS concern and review tunnel peer membership.
RemediationAI
Apply the fixed VeloCloud Edge and VeloCloud Gateway software releases published in Arista Security Advisory 0180 (https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180); the exact patched version numbers are not specified in the provided intelligence, so confirm the target release against the advisory before upgrading. Because the exposure depends on trusted overlay membership, reduce the peer set: rotate or revoke VCMP peer credentials and PSKs for any Edge or Gateway that is suspected compromised or untrusted, and enforce strict peer allow-listing so only known-good overlay members can establish tunnels - the trade-off is that mis-scoped allow-lists will break legitimate SD-WAN peering and require careful rollout. Where fragment handling is not required across the overlay, consider filtering or dropping IP fragments at the tunnel boundary, accepting that this may disrupt legitimate fragmented application traffic; alternatively, segment affected Edges/Gateways into their own overlay so a restart-induced outage cannot cascade into other sites. Monitor for repeated VCMP process restarts or tunnel re-establishment bursts as an indicator of exploitation attempts, and treat any anomalous fragment traffic from an authenticated peer as a potential compromise of that peer.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-787 out-of-bounds write reached in the VeloCloud VCMP (VeloCloud Management/Control Protocol) tunnel implementation, which carries traffic between SD-WAN overlay peers. When a peer transmits tunneled IP fragments, the fragment-processing path writes beyond the bounds of its intended buffer, corrupting memory and triggering a process fault that the supervisor restarts. Because the malformed input must arrive over an established VCMP tunnel, the attack surface is the overlay control/data plane rather than any internet-facing service, which is reflected in the assessed vector's PR:L (authenticated peer) and AC:H (crafting the fragment sequence reliably is non-trivial). CPE data (cpe:2.3:a:arista_networks:velocloud:* and cpe:2.3:a:arista_networks:velocloud_gateway:*) indicates the CPE catalogues these products without version constraints, so the advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180 should be consulted for the precise affected release set. The vulnerability is limited strictly to the VCMP tunnel protocol; no other protocol path is implicated.
Know when Velocloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Reachable only by an authenticated overlay peer so PR:L (not PR:N), crafting valid malformed fragments is hard so AC:H; impact is a transient process restart only, hence C:N/I:N/A:H.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.
A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
Executive ViewAI
Arista's VeloCloud Edge and VeloCloud Gateway SD-WAN platforms contain an out-of-bounds write in the VCMP tunnel protocol that can crash and restart the affected node's process, briefly interrupting traffic on that device. Exploitation requires the attacker to already hold an authenticated overlay peer relationship with the target, so exposure is confined to environments where overlay trust is broadly granted or a peer device has been compromised, and no code execution or data exposure has been demonstrated. Leadership should treat this as an availability risk to branch and WAN connectivity rather than a data-breach risk, with priority driven by how much overlay peering your environment permits.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict VCMP peer relationships to known, managed overlay neighbors and remove unnecessary or stale peers; alert on process restarts, tunnel flapping, and unexpected peer churn on VeloCloud Edge and Gateway nodes; ensure redundant WAN paths or failover so a single node restart does not interrupt branch traffic; and engage Arista TAC for advisory status, workarounds, or a target fix release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB