EUVD-2026-80586
GHSA-665h-qpgj-xrwp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain foothold on shared OSPFv3 broadcast domain
-
DeliveryCraft malicious OSPFv3 packet sequence
-
ExploitSend packets to trigger Ospf3 agent fault
-
ExecutionAgent restarts, adjacencies drop
-
ImpactRouting disrupted across OSPF domain
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Requires (1) the target Arista EOS device to have OSPFv3 explicitly configured, and (2) the attacker to be positioned on the SAME OSPFv3 broadcast domain (adjacent/link-local L2 segment), not routable Internet reach. Exploitation further requires sending a specially crafted SET of packets (a multi-packet sequence, reflected as AT:P), not a single stray packet. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: devices without OSPFv3, or with OSPFv3 restricted to trusted point-to-point links or authenticated/segmented adjacencies, are not realistically exposed; impact is a transient routing outage that self-recovers when the agent restarts, with no data compromise. |
| Impact | This is a genuine availability-only denial-of-service issue, not a confidentiality/integrity threat: the CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N) sets VC:N/VI:N but VA:H and SA:H, meaning only availability is impacted - both on the local device and, via the subsequent-system metric, across the broader OSPF routing domain. The realistic risk is materially bounded by the attack vector: AV:A means the attacker must be on the same OSPFv3 broadcast (link-local) domain, not the general Internet, and AT:P/PR:N indicates a specially crafted SET of packets is required (a state/sequence condition) rather than a single trivial packet. There is no EPSS score, no KEV listing, and no public PoC in the provided data; Arista explicitly states it is unaware of any malicious exploitation, so this is no public exploit identified at time of analysis rather than an actively-exploited priority. Net: a high-CVSS-looking (7.0) but real-world-moderate issue - patch on normal cadence, prioritized higher only for devices where OSPFv3 runs on untrusted or multi-tenant L2 segments. Note the vendor's published CVSS 4.0 (7.0) captures the broader routing disruption as a subsequent-system impact (SA:H), which is the main driver lifting the score above a purely local restart. |
| Exploit ScenarioDerived | An attacker with a foothold on a network segment that shares an OSPFv3 broadcast domain with the target (e.g. a compromised host, rogue device, or malicious peer on the same L2 link) transmits a crafted sequence of OSPFv3 packets. This restarts the Ospf3 agent, tearing down all OSPFv3 adjacencies on the device and rippling routing instability across the OSPF domain until the agent recovers. No public exploit code is identified, and the crafted-packet-set requirement (AT:P) makes this less trivial than a single-packet crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks.
Earlier versions of this analysis (1)
Denial of service in Arista EOS: an unauthenticated attacker located on the same OSPFv3 broadcast domain can send a specially crafted set of packets that forces the Ospf3 agent to restart unexpectedly, tearing down all OSPFv3 adjacencies on the affected switch or router and potentially disrupting routing across the wider OSPF domain until the agent recovers. The issue is a reachable-assertion class flaw (CWE-617) that only affects devices actively configured for OSPFv3, and it carries a CVSS v3.1 base score of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), so impact is confined to availability with no confidentiality or integrity loss. Arista, which received the report externally from Dravanet Inc., states it is not aware of malicious exploitation in customer networks, and no public exploit identified at time of analysis.
RemediationAI
Arista published Security Advisory 0172 (https://www.arista.com/en/support/advisories-notices/security-advisory/24728-security-advisory-0172) covering this defect; consult that advisory for the exact fixed EOS releases for your platform and train, since no specific patched version number is provided in the available data, and upgrade to the recommended maintenance release as the primary fix. Until an upgrade can be scheduled, reduce exposure by confining OSPFv3 to point-to-point links or trusted segments so no untrusted host shares the OSPFv3 broadcast domain, since broadcast-segment adjacency is the prerequisite for the attack and this is the single most effective compensating control, though it requires topology rework. Enabling OSPFv3 authentication (IPsec AH/ESP or equivalent) raises the bar because forged packets that fail authentication are discarded, but it does not repair the underlying parser and must be rolled out consistently across all neighbors to avoid adjacency loss during the change window. Additional hardening includes applying L2 access controls, private VLANs, or port-based segmentation to block unauthorized hosts from reaching OSPFv3 multicast groups, and monitoring for unexpected Ospf3 agent restarts and adjacency flaps as a detection signal; note that each of these controls adds configuration complexity and may constrain legitimate OSPFv3 neighbor additions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in the OSPFv3 routing agent (Ospf3) of Arista EOS, the network operating system running on Arista switches and routers. CWE-617 (Reachable Assertion) indicates the agent hits an internal assertion or equivalent fatal guard when parsing a malformed but syntactically deliverable sequence of OSPFv3 protocol packets, causing an abnormal process termination and restart rather than graceful error handling. OSPFv3 is the IPv6-capable variant of the OSPF link-state routing protocol, and it relies on multicast hello/adjacency maintenance on broadcast segments, which is why an attacker must already be present on the same L2 broadcast domain to inject packets that the agent will process as legitimate adjacency traffic. The affected product identifier is cpe:2.3:a:arista_networks:eos:*:*:*:*:*:*:*:*, indicating the impact spans EOS releases broadly rather than a single build. The CVSS 4.0 vector rates AV:A with AT:P, meaning attack complexity is low once adjacency is achieved but the attacker must deliver a coordinated set of packets rather than a single forged frame; VC:N/VI:N with VA:H and subsequent-system availability SA:H confirms the consequence is confined to service availability, both on the directly targeted device and downstream along OSPF-reliant paths.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
AV:A for link-local OSPFv3 domain, AC:H for the crafted packet sequence, PR:N/UI:N unauthenticated; S:C because the crash disrupts routing beyond the device, A:H availability-only with C:N/I:N.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
5DescriptionCVE.org
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.
Executive ViewAI
A denial-of-service flaw in Arista EOS can force the OSPFv3 routing agent to restart when OSPFv3 is explicitly configured, collapsing IPv6 routing adjacencies and potentially propagating a routing outage beyond the affected device. Only organizations running Arista EOS with OSPFv3 enabled are exposed, and an attacker must already hold a link-local/L2-adjacent position on the same OSPFv3 broadcast domain, such as a compromised access port, poorly segmented segment, or a hostile device on a shared subnet. Because the impact is availability-only - no data theft or tampering - leadership should treat this as a network resilience and segmentation risk concentrated in data center and campus IPv6 routing infrastructure. No public exploit code has been identified at time of analysis and Arista states it is not aware of malicious exploitation in customer networks.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict OSPFv3 to explicitly required interfaces and disable it where unused; enforce OSPFv3 authentication (IPsec AH/ESP) so only trusted neighbors can inject routing packets; apply CoPP/control-plane ACLs and Layer 2 controls (port security, 802.1X, VLAN segmentation) to deny untrusted L2-adjacent devices access to the OSPFv3 broadcast domain; ensure redundant paths, BFD, and fast convergence so an agent restart does not cascade into a domain-wide routing outage; and monitor and alert on Ospf3 agent restarts and adjacency flaps. Engage Arista TAC for vendor-recommended workarounds and patch timing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB