EUVD-2026-80586
GHSA-665h-qpgj-xrwp
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A for link-local OSPFv3 domain, AC:H for the crafted packet sequence, PR:N/UI:N unauthenticated; S:C because the crash disrupts routing beyond the device, A:H availability-only with C:N/I:N.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
8DescriptionCVE.org
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.
AnalysisAI
A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) the target Arista EOS device to have OSPFv3 explicitly configured, and (2) the attacker to be positioned on the SAME OSPFv3 broadcast domain (adjacent/link-local L2 segment), not routable Internet reach. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine availability-only denial-of-service issue, not a confidentiality/integrity threat: the CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N) sets VC:N/VI:N but VA:H and SA:H, meaning only availability is impacted - both on the local device and, via the subsequent-system metric, across the broader OSPF routing domain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Arista published Security Advisory 0172 (https://www.arista.com/en/support/advisories-notices/security-advisory/24728-security-advisory-0172) covering this defect; consult that advisory for the exact fixed EOS releases for your platform and train, since no specific patched version number is provided in the available data, and upgrade to the recommended maintenance release as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Arista EOS device running OSPFv3, confirm which interfaces participate in OSPFv3 broadcast domains, and open a case with Arista TAC referencing CVE-2026-73438 to obtain the vendor's current guidance, workaround, and target fix timeline; simultaneously apply control-plane protection by tightening CoPP/ACLs and OSPFv3 authentication (IPsec AH/ESP or equivalent) so only trusted neighbors can source OSPFv3 packets, and disable OSPFv3 on any interface or platform where it is not explicitly required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today