EUVD-2026-80592
GHSA-x98h-73r2-4gwf
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent L2 vector (AV:A) with no auth or interaction; availability-only impact (A:H, temporary multicast loss) and no confidentiality or integrity effect.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
8DescriptionCVE.org
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
AnalysisAI
Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to be positioned on the same L2/adjacent network segment as an affected interface (CVSS AV:A - not remotely routable), and requires that the affected EOS device has multicast forwarding actively configured on those interfaces (PIM/IGMP multicast routing must be in use for 'multicast forwarding state' to exist and be expirable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an availability-only denial-of-service issue in Arista EOS, not the confidentiality problem its 'Information Disclosure' tag implies (the CVSS 4.0 vector confirms VC:N/VI:N with only VA:H, temporary multicast traffic loss). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the provided data, so the primary action is to consult Arista Security Advisory 0175 (https://www.arista.com/en/support/advisories-notices/security-advisory/24731-security-advisory-0175) to determine which EOS release trains are affected and to upgrade to the fixed release Arista specifies for the relevant train; do not assume a version number that is not stated in that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether multicast forwarding (PIM/IGMP) is actively configured on any Arista EOS interfaces, prioritize that inventory as the exposed surface, and review vendor security advisories for CVE-2026-73468 since no vendor-released patch has been identified at time of analysis; harden Layer 2 adjacency by tightening port security, disabling unused switch ports, and enabling DHCP snooping and Dynamic ARP Inspection on access segments to reduce the attacker's ability to inject crafted multicast packets. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. Rated high severity (C
Share
External POC / Exploit Code
Leaving vuln.today