EUVD-2026-80996
GHSA-vq3p-3r98-j8w8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent L2 access required (AV:A) and no auth needed to replay captured packets (PR:N); impact is limited gateway DoS only (A:L), with no confidentiality or integrity effect.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
2DescriptionCVE.org
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.
AnalysisAI
Denial of service in Arista EOS affects devices that have VRRPv2 with IP Authentication Header (IP-AH) authentication explicitly configured - a non-default hardening option, so exposure is limited to networks that opted into it. An unauthenticated attacker positioned on the same layer-2 segment as the VRRP group can passively capture a legitimate authenticated VRRP advertisement and replay it indefinitely, keeping a stale master state alive and preventing a backup router from taking over the virtual gateway; hosts relying on that gateway address then lose connectivity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the affected device to be running Arista EOS with VRRPv2 IP-AH authentication explicitly configured (a non-default hardening option) - the flaw does not exist without this feature enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-severity availability issue, and the vendor CVSS 4.0 score of 5.3 (AV:A/AC:L/AT:N/PR:N/UI:N/VA:L) is a fair characterization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch availability was not confirmed in the supplied data - the authoritative source is Arista Security Advisory 0157 (https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157), which should be consulted for the exact EOS releases that resolve the replay behaviour; per the precision rules above, no specific fix version is asserted here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today