Arista EOS EUVD-2026-80996

Requires the affected device to be running Arista EOS with VRRPv2 IP-AH authentication explicitly configured (a non-default hardening option) - the flaw does not exist without this feature enabled. The attacker must be unauthenticated but positioned within the same layer-2 network segment on which VRRP operates (AV:A adjacency), limiting exploitation to insiders, compromised local hosts, or attackers with VLAN/physical access. Impact is denial-of-service only: replayed advertisements suppress backup-router failover, denying gateway reachability; there is no confidentiality or integrity impact and no code execution.

This is a genuine but low-severity availability issue, and the vendor CVSS 4.0 score of 5.3 (AV:A/AC:L/AT:N/PR:N/UI:N/VA:L) is a fair characterization. The single most important limiting signal is the ADJACENT attack vector: the attacker must already have a foothold on the same layer-2 segment where VRRP is running, which sharply narrows the realistic attacker population to insiders, compromised hosts, or an attacker with physical/VLAN access. Confidentiality and integrity impacts are both None - this is purely a denial-of-service (VA:L) affecting hosts that rely on the virtual gateway. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no evidence of active exploitation; the flaw's value to an attacker is limited to disrupting gateway failover rather than gaining access. CWE-294 (capture-replay) is accurate - the root cause is that VRRPv2 IP-AH authentication lacks anti-replay protection, so captured advertisements remain valid indefinitely. Net: this is a legitimate low-to-moderate risk driven by the adjacency requirement and DoS-only impact, not a high-priority remotely-exploitable vulnerability, and it is further gated by a non-default authentication configuration.

An attacker positioned on the same broadcast domain as the VRRP routers (e.g. via a compromised host or rogue port on the VLAN) passively captures a valid IP-AH-authenticated VRRPv2 advertisement from the master router. When the master fails, the attacker replays the captured advertisement to keep asserting stale master state, preventing the backup from taking over and denying gateway service to downstream hosts. No public exploit code was identified at time of analysis, but the technique requires only standard packet capture and replay tooling.