EUVD-2026-80587
GHSA-qpgp-r7c9-594m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to OSPFv3 segment
-
DeliveryCraft malformed OSPFv3 packet
-
ExploitSend to EOS device
-
ExecutionTrigger length-handling fault
-
PersistOSPFv3 agent restarts
-
ImpactRouting adjacencies drop
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Length parameter validation
|
| Exploitation Conditions | Exploitation requires the affected Arista EOS device to have OSPFv3 explicitly configured - not a default state, which is the primary limiting factor. Because OSPFv3 operates over link-local multicast, the attacker realistically must be positioned on the same OSPFv3-participating network segment/adjacency domain rather than arbitrarily across the internet, and the CVSS 4.0 AT:P flag signals a required precondition (a specifically crafted packet). No authentication is required (PR:N) and no user interaction (UI:N), but impact is limited to a transient OSPFv3 agent restart and routing disruption; there is no code execution, data read, or persistence. |
| Impact | This is an availability-only denial-of-service flaw (CWE-130, improper handling of length/count) in the OSPFv3 agent of Arista EOS: a crafted packet causes an unexpected agent restart. The vendor CVSS 4.0 vector (8.9) shows AV:N/AC:L/PR:N/UI:N with VC:N/VI:N/VA:H and SA:H, plus AT:P (an attack requirement / precondition), so confidentiality and integrity are explicitly untouched - the 'Information Disclosure' tag directly contradicts the vector and is wrong. There is no EPSS score, no CISA KEV listing, and no known POC in the provided data, so this is currently 'no public exploit identified at time of analysis'; it is not evidence of active exploitation. The most important calibration caveat: OSPFv3 is a link-local routing protocol (packets sent to well-known multicast on the local segment), so the vendor's AV:N is generous - realistic exploitation requires an attacker on the same OSPFv3 broadcast/adjacency domain, which is closer to adjacent (AV:A). Real-world priority is moderate: high impact if triggered (routing disruption) but gated on OSPFv3 being configured and on the attacker having on-segment access, and impact is transient (agent restart) rather than persistent compromise. Note the score discrepancy across scoring systems - verify AV with Arista advisory 24729. |
| Exploit ScenarioDerived | An attacker with access to a network segment participating in OSPFv3 sends a specially crafted OSPFv3 packet to a vulnerable Arista EOS device. The malformed packet triggers a length/count-handling fault, causing the OSPFv3 agent to restart, dropping adjacencies and disrupting IPv6 routing convergence. No public exploit code is identified at time of analysis, and repeated packets could sustain the disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Crafted OSPFv3 packets can force an unexpected restart of the OSPFv3 routing agent on Arista EOS devices that have OSPFv3 configured, causing a transient loss of routing adjacencies and traffic disruption. The flaw is an availability-only denial of service (CWE-130 improper handling of length parameters) with no code execution, data disclosure, or persistence; no authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation depends on a preconditioned packet and, per our assessment, an attacker positioned on the same OSPFv3-participating link or adjacency domain rather than arbitrarily across the internet. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published Security Advisory 0173.
Earlier versions of this analysis (1)
Malformed OSPFv3 packets can force the OSPFv3 routing agent on Arista EOS to restart unexpectedly, disrupting IPv6 routing adjacency and control-plane availability on the affected device. The trigger is unauthenticated (CVSS:3.1/PR:N), but exposure is bounded: the device must be running EOS with OSPFv3 explicitly configured and active on an interface, and because OSPFv3 is a link-local protocol exchanged between adjacent routers, practical packet delivery generally requires a position on the OSPF-speaking segment or inside the routing domain - which is why our independent assessment places the vector at AV:A rather than the advertised AV:N. Impact is availability-only (C:N/I:N/A:H) with no confidentiality or integrity effect, and no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified in the provided data at time of analysis; consult Arista Security Advisory 0173 (https://www.arista.com/en/support/advisories-notices/security-advisory/24729-security-advisory-0173) for the fixed EOS release and upgrade path, and treat the advisory as the authoritative source before deploying any version. Where an immediate upgrade is not possible, compensating controls center on shrinking the injection surface: disable OSPFv3 if it is not operationally required (removes exposure entirely, but loses dynamic IPv6 routing); enable OSPFv3 authentication (RFC 7166 authentication trailer or IPsec for OSPFv3) so off-path or unauthorized speakers on the segment cannot inject crafted LSAs (requires coordinated key configuration across all adjacencies and does not stop a compromised authenticated peer); and enforce strict Layer 2/edge filtering of OSPFv3 link-local multicast (ff02::5/ff02::6) at access and peering boundaries so only trusted routers can speak OSPFv3, which may break legitimate multirouter adjacencies if over-applied. Additionally, monitor syslog and process-restart telemetry for repeated OSPFv3 agent restarts as an exploitation indicator, and be aware that each induced restart causes routing reconvergence and transient traffic loss while the fix is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OSPFv3 is the IPv6 routing protocol that exchanges link-state advertisements between routers over link-local multicast (ff02::5 / ff02::6) on directly connected segments. The vulnerability is classified as CWE-130 (Improper Handling of Length Parameter Inconsistency): a specially crafted OSPFv3 packet presents length or count fields that the agent does not validate consistently against actual packet contents, resulting in a parsing/handling failure that terminates the OSPFv3 process. Affected CPE data identifies the impacted platform as Arista EOS (cpe:2.3:a:arista_networks:eos), so any EOS release with OSPFv3 enabled inherits the exposure. The reported CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, with VA:H and SA:H) scores 8.9, while our independent assessment scores it 8.1 under CVSS 3.1 with AV:A, reflecting that OSPFv3 adjacency injection realistically requires adjacency-segment access and therefore lowers the effective attack surface from network-wide to segment-local. Both vectors agree on an unauthenticated, no-interaction, availability-only impact. Note that the supplied tag metadata references "Information Disclosure," which is not supported by the description or by either scored vector and appears to be a tagging artifact; the confirmed impact is availability only. Vulnerable conditions require OSPFv3 to be explicitly configured, which is not a default state on EOS and is the primary limiting factor.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
OSPFv3 is link-local, so AV:A is more honest than vendor AV:N; no auth needed (PR:N); crafted packet is low-complexity; impact is availability-only agent restart (C:N/I:N/A:H).
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
Executive ViewAI
A high-severity availability flaw in Arista EOS (CVE-2026-73455, CVSS 8.9) allows a crafted OSPFv3 packet to restart the device's OSPFv3 routing agent, briefly breaking routing adjacencies and disrupting traffic on any network segment where OSPFv3 is configured. The attacker must already sit on an OSPFv3-participating link or adjacency domain, so internet-facing exposure is limited, but core, distribution, and data-center fabrics built on Arista EOS are the assets at risk. Because this is availability-only with no code execution or data disclosure, the leadership concern is unplanned network downtime and service interruption rather than data loss - though repeated triggering could cause sustained routing instability. No public exploit code or active exploitation has been identified, and no vendor patch is currently available, making interim mitigation the primary near-term control.
No vendor-released patch identified at time of analysis. Interim mitigations: disable OSPFv3 where not required; enable OSPFv3 authentication (IPsec AH/ESP or vendor-supported authentication) on all participating interfaces; restrict Layer 2 and physical access to OSPFv3 links and enforce port security; apply control-plane policing to rate-limit OSPFv3 and routing-protocol traffic to the route processor; monitor and alert on OSPFv3 adjacency drops and routing-agent restarts; engage Arista support via Security Advisory 0173 for a pre-release fix or vendor-recommended workaround.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB