EUVD-2026-34858
GHSA-mcx4-vm6v-r473
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
On affected platforms running Arista EOS where a tunnel decapsulation configuration-such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface-is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.
This issue has been reported as being exploited in the wild.
Articles & Coverage 1
AnalysisAI
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet destined for a configured decapsulation IP to be silently unwrapped and forwarded into the network. Unauthenticated remote attackers (PR:N, AV:N per CVSS 4.0) can inject traffic into network segments by exploiting this check bypass on switches with VXLAN, decap-groups, or GRE configurations. The CVE description explicitly states this issue has been reported as exploited in the wild; however, a CISA KEV entry was not confirmed in the provided data. The integrity impact is assessed as low on both the vulnerable and subsequent systems per CVSS 4.0 (VI:L/SI:L), but the network trust boundary violation in a core switching context warrants elevated operational priority.
Technical ContextAI
Arista EOS (cpe:2.3:a:arista_networks:eos:*:*:*:*:*:*:*:*) is the network operating system powering Arista datacenter and campus switches. The affected code path handles tunnel decapsulation for overlay protocols: VXLAN (UDP-encapsulated L2 frames over IP, typically port 4789), GRE (IP-in-IP generic encapsulation, protocol 47), and custom decap-groups. CWE-1023 (Incomplete Comparison with Missing Factors) is the root cause: the switch evaluates whether the destination IP matches a configured decapsulation endpoint but omits validating the encapsulation protocol field. This means a GRE-configured switch will also decapsulate VXLAN or arbitrary IP-in-IP traffic arriving at the same IP, violating the expected protocol boundary. In overlay network designs, tunnel endpoints are trusted demarcation points - bypassing protocol-type enforcement undermines network segmentation and tenant isolation.
RemediationAI
The primary remediation is to apply the vendor-released patch per Arista Security Advisory 0137, available at https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137. An exact fixed EOS version was not present in the provided data and must be confirmed from that advisory before upgrading. As a compensating control where immediate patching is not feasible, restrict which source IPs can send tunneled traffic to decapsulation endpoints using ACLs or firewall rules at the network perimeter, limiting exposure to trusted tunnel peers only - note this adds operational overhead and may not block insider threats. Additionally, if decap-groups or GRE tunnel interfaces are not actively required, temporarily removing the tunnel decapsulation configuration eliminates the vulnerable code path entirely but will disrupt overlay networking services. Operators should audit which tunnel protocols are legitimately in use and enforce protocol-specific ACLs as an interim control until patching is complete.
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attack
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA
An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issu
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today