CVE-2026-7473
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
Что произошло
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
Что это значит
В источнике описана ошибка безопасности в перечисленных продуктах. Фактический риск зависит от установленной версии, конфигурации и доступности компонента; проверьте условия в первичном бюллетене.
Что делать
Требование CISA: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
1. Проверьте, затронуты ли вы
Соберите инвентаризацию и сравните с таблицей затронутых версий. Эти команды только показывают установленные компоненты и сами по себе не доказывают наличие CVE.
dpkg-query -W -f='${Package} ${Version}\n'rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'Get-HotFix | Select-Object HotFixID, InstalledOn
2. Установите исправление
No software upgrade path is planned to address this issue due to the risk of breaking existing configuration on deployments. The recommended resolution of this issue is to follow the appropriate mitigation instructions detailed in the workaround block.
3. Временные меры
There are two broad approaches to mitigate this issue - (1) applying ACLs on upstream devices or (2) applying ACLs on the devices where the unexpected decapsulation is happening. In both cases, the idea is to either selectively allow only legitimate tunnel traffic or to selectively block malicious tunnel traffic. For example, if a network is configured to forward VXLAN traffic, but GRE traffic is being unexpectedly forwarded, then ACLs can be used to either selectively allow just VXLAN traffic or selectively block GRE traffic. More details about using the ACL feature can be found in the Arista User Manual https://www.arista.com/en/um-eos/eos-acls-and-route-maps#xx1150869 . A note of caution, the following ACL-based mitigation recommendations assume that the tunnel IP is dedicated solely to receiving the configured tunnel protocol traffic. When adapting these rules for your environment, it is important to explicitly permit any additional protocol traffic—such as BGP or SSH—if that IP serves multiple functions. To maintain connectivity, ensure these permit statements are sequenced before any deny statements directed at the decapsulation IP. The following configurations align with the recommendations outlined in the Arista EOS Hardening Guide https://arista.my.site.com/AristaCommunity/s/article/arista-eos-hardening-guide#Comm_Kna_ka0Uw00000097VJIAY_71 .
Approach 1 - Applying ACL on Upstream Switches On upstream devices, applying ACLs to allow specific tunneled traffic is straightforward. ACLs can be applied that match on tunnel destination IP, the IP next protocol field, and (optionally) UDP destination port to selectively allow or block specific tunnel protocols. Example ACLs for Arista EOS follows. ACL to permit VXLANv4 Only This IPv4 ACL matches on VXLAN packets as follows: (a) IP next protocol = UDP (17) (b) IP DIP = VXLAN VTEP IP (c) UDP destination port = VXLAN UDP Port (4789) It allows VXLAN packets and drops all other packets to the VXLAN Decap IP. ip access-list foo counters per-entry 1 permit udp any host eq 4789 2 deny ip any host 3 permit ip any any ACL to permit GREv4 Only This IPv4 ACL matches on GRE packets as follows: (a) IP next protocol = GRE (47) (b) IP DIP = GRE Tunnel Destination IP It allows GRE packets and drops all other packets to the GRE Decap IP. ip access-list foo counters per-entry 1 permit gre any host 2 deny ip any host 3 permit any any ACL to permit IP-in-IPv4 Only This IPv4 ACL matches on IP-in-IPv4 packets as follows: (a) IP next protocol = IPv4 (4) or IPv6 (41) (b) IP DIP = IP-in-IP Decap IP It allows IP-in-IPv4 packets and drops all other packets to the IP-in-IPv4 Decap IP. ip access-list foo counters per-entry 1 permit 4 any host 2 permit 41 any host 3 deny ip any host 4 permit any any ACL to Permit IP-in-IPv6 Only This IPv6 ACL matches on IP-in-IPv6 packets as follows: (a) IP next protocol = IPv4 (4) or IPv6 (41) (b) IP DIP = IP-in-IP Decap IP It allows IP-in-IPv6 packets and drops all other packets to the IP-in-IPv6 Decap IP. ipv6 access-list foo counters per-entry 1 permit 4 any host 2 permit 41 any host 3 deny ipv6 any host 4 permit ipv6 any any ACL to permit GUEv4 Only This IPv4 ACL matches on GUE packets as follows: (a) IP next protocol = UDP (17) (b) IP DIP = GUE Decap IP (c) UDP destination port = UDP port configured per payload (IP = Y or MPLS = Z) It allows GUE packets and drops all other packets to the GUE Decap IP. ip access-list foo counters per-entry 1 permit udp any host eq Y 2 permit udp any host eq Z 3 deny ip any host 4 permit ip any any ACL to Permit GUEv6 Only This IPv6 ACL matches on GUE packets as follows: (a) IP next protocol = UDP (17) (b) IP DIP = GUE Decap IP (c) UDP destination port = UDP port configured per payload (IP = Y or MPLS = Z) It allows GUE packets and drops all other packets to the GUE Decap IP. ipv6 access-list foo counters per-entry 1 permit udp any host eq Y 2 permit udp any host eq Z 3 deny ipv6 any host 4 permit ipv6 any any
Approach 2 - Applying ACL on Decapsulation Switches Applying ACLs on the decapsulation device is more complicated. It requires the use of MAC ACLs on 7020R Series, 7280R/R2 Series, and 7500R/R2 Series systems and IP ACLs on 7280R3 Series, 7500R3 Series, and 7800R3 Series systems. In both cases, a TCAM profile update is also required. Note that TCAM profile update is a disruptive operation that could impact traffic forwarding. More information can be found in User-defined TCAM Profiles https://www.arista.com/en/support/toi/eos-4-26-0f/14755-user-defined-tcam-profiles . 7020R Series, 7280R/R2 Series, and 7500R/R2 Series Mitigation involves using MAC ACLs to allow specific expected protocol packets and block all other traffic to the configured decap IPs. The suggested MAC ACLs use User Defined Fields (UDFs) to match on specific fields in the packet headers. This requires a TCAM profile update to include the following UDF qualifiers: * For IPv4 tunnels, 2 16b and 1 32b UDF qualifiers need to be included. * For IPv6 tunnels, 2 16b and 4 32b UDF qualifiers need to be included. However, in order to make room for the UDF qualifiers, other TCAM features/qualifiers must be removed due to hardware constraints. Following are some suggested TCAM profile changes to accommodate the required UDF qualifiers: * TCAM profile that includes the UDF qualifiers for IPv4 tunnels, but removes support for MPLS: hardware tcam profile test copy default feature acl port mac no key size limit key field udf-16b-1 udf-16b-2 udf-32b-1 no feature mpls no feature mpls pop ingress no feature pbr mpls * TCAM profile that includes the UDF qualifiers for IPv4 tunnels, but removes support for VXLAN: hardware tcam profile test copy default feature acl port mac no key field src-mac key field udf-16b-1 udf-16b-2 udf-32b-1 * TCAM profile that includes the UDF qualifiers for IPv6 tunnels, but removes support for VXLAN and PBR: hardware tcam profile test1 copy default feature acl port mac no key size limit no key field src-mac dst-mac key field udf-16b-1 udf-16b-2 udf-32b-1 udf-32b-2 udf-32b-3 udf-32b-4 no feature tunnel vxlan no feature tunnel vxlan routing no feature pbr ip no feature pbr ipv6 Please contact Arista TAC if further assistance is needed with TCAM profile construction.
ACL to permit VXLAN v4 Decap only This MAC ACL uses UDF to match on VXLAN packets as follows: (a) IP next protocol = UDP (0x11) (b) IP DIP = VXLAN VTEP IP (say 0xXXXXXXXX - converted in hex) (c) UDP destination port = VXLAN UDP Port (0x12b5) It allows VXLAN packets and drops all other packets to the VXLAN Decap IP. mac access-list payload alias ip-next-protocol-udp offset 2 pattern 0x00110000 mask 0xff00ffff mac access-list payload alias ip-dip-decap-ip offset 4 pattern 0xXXXXXXXX mask 0x00000000 mac access-list payload alias udp-dport-vxlan offset 5 pattern 0x000012b5 mask 0xffff0000 mac access-list foo counters per-entry 1 permit any any ip payload alias ip-next-protocol-udp alias ip-dip-decap-ip alias udp-dport-vxlan 2 deny any any ip payload alias ip-dip-decap-ip 3 permit any any ACL to permit GREv4 Decap Only This MAC ACL uses UDF to match on GRE packets as follows: (a) IP next protocol = GRE (0x2f) (b) IP DIP = GRE Decap IP (say 0xXXXXXXXX - converted in hex) It allows GRE packets and drops all other packets to the GRE Decap IP. mac access-list payload alias ip-next-protocol-gre offset 2 pattern 0x002f0000 mask 0xff00ffff mac access-list payload alias ip-dip-decap-ip offset 4 pattern 0xXXXXXXXX mask 0x00000000 mac access-list foo counters per-entry 1 permit any any ip payload alias ip-next-protocol-gre alias ip-dip-decap-ip 2 deny any any ip payload alias ip-dip-decap-ip 3 permit any any If needed, the ACL can also be tweaked to match on specific GRE payloads as follows: IPv4oGRE ACL also matches on GRE next protocol = IPv4 (0x0800) mac access-list payload alias gre-protocol-ipv4 offset 5 pattern 0x00000800 mask 0xffff0000 mac access-list foo counters per-entry 1 permit any any ip payload alias ip-next-protocol-gre alias ip-dip-decap-ip alias gre-protocol-ipv4 2 deny any any ip payload alias ip-dip-decap-ip 3 permit any any IPv6oGRE ACL also matches on GRE next protocol = IPv6 (0x86dd) mac access-list payload alias gre-protocol-ipv6 offset 5 pattern 0x000086dd mask 0xffff0000 mac access-list foo counters per-entry 1 permit any any ip payload alias ip-next-protocol-gre alias ip-dip-decap-ip alias gre-protocol-ipv6 2 deny any any ip payload alias ip-dip-decap-ip 3 permit any any MPLSoGRE ACL also matches on GRE next protocol = MPLS (0x8847) mac access-list payload alias gre-protocol-mpls offset 5 pattern 0x00008847 mask 0xffff0000 mac access-list foo counters per-entry 1 permit any any ip payload alias ip-next-protocol-gre alias ip-dip-decap-ip alias gre-protocol-mpls 2 deny any any ip payload alias ip-dip-decap-ip 3 permit any any
ACL to permit IP-in-IPv4 Decap Only This MAC ACL uses UDF to match on IP-in-IP packets as follows: (a) IP next protocol = IPv4 (0x04) or IPv6 (0x29) (b) IP DIP = IP-in-IP Decap IP (say 0xXXXXXXXX - converted in hex) It allows IP-in-ip packets and drops all other packets to the IP-in-IP Decap IP. mac access-list payload alias ip-next-protocol-ipv4 offset 2 pattern 0x00040000 mask 0xff00ffff mac access-list payload alias ip-next-protocol-ipv6 offset 2 pattern 0x00290000 mask 0xff00ffff mac access-list payload alias ip-dip-decap-ip offset 4 pattern 0xXXXXXXXX mask 0x00000000 mac access-list foo counters per-entry 1 permit any any ip payload alias ip-next-protocol-ipv4 alias ip-dip-decap-ip 2 permit any any ip payload alias ip-next-protocol-ipv6 alias ip-dip-decap-ip 3 deny any any ip payload alias ip-dip-decap-ip 4 permit any any ACL to permit GUEv4 Decap Only This MAC ACL uses UDF to match on GUE packets as follows: (a) IP next protocol = UDP (0x11) (b) IP DIP = GUE Decap IP (say 0xXXXXXXXX - converted in hex) (c) UDP destination port = UDP port configured per payload (say UDP port for IP payload = 0xYYYY or UDP port for MPLS payload = 0xZZZZ - converted in hex) It allows GUE packets and drops all other packets to the GUE Decap IP. mac access-list payload alias ip-next-protocol-udp offset 2 pattern 0x00110000 mask 0xff00ffff mac access-list payload alias ip-dip-decap-ip offset 4 pattern 0xXXXXXXXX mask 0x00000000 mac access-list payload alias udp-dport-gue-ip offset 5 pattern 0x0000YYYY mask 0xffff0000 mac access-list payload alias udp-dport-gue-mpls offset 5 pattern 0x0000ZZZZ mask 0xffff0000 mac access-list foo 1 permit any any ip payload alias ip-next-protocol-udp alias ip-dip-decap-ip alias udp-dport-gue-mpls 2 permit any any ip payload alias ip-next-protocol-udp alias ip-dip-decap-ip alias udp-dport-gue-ip 3 deny any any ip payload alias ip-dip-decap-ip 4 permit any any ACL to permit GUEv6 Decap Only This MAC ACL uses UDF to match on GUE packets as follows: (a) IP next protocol = UDP (0x11) (b) IPv6 DIP = GUE Decap IP (say 0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD - converted in hex) (c) UDP destination port = UDP port configured per payload (say UDP port for IP payload = 0xYYYY or UDP port for MPLS payload = 0xZZZZ - converted in hex) It allows GUE packets and drops all other packets to the GUE Decap IP. mac access-list payload alias ipv6-next-protocol-udp offset 1 pattern 0x00001100 mask 0xffff00ff mac access-list payload alias udp-dport-gue-ip offset 10 pattern 0x0000YYYY mask 0xffff0000 mac access-list payload alias udp-dport-gue-mpls offset 10 pattern 0x0000ZZZZ mask 0xffff0000 mac access-list payload alias ipv6-dip-decap-ip1 offset 6 pattern 0xAAAAAAAA mask 0 mac access-list payload alias ipv6-dip-decap-ip2 offset 7 pattern 0xBBBBBBBB mask 0 mac access-list payload alias ipv6-dip-decap-ip3 offset 8 pattern 0xCCCCCCCC mask 0 mac access-list payload alias ipv6-dip-decap-ip4 offset 9 pattern 0xDDDDDDDD mask 0 mac access-list foo counters per-entry 1 permit any any ipv6 payload alias ipv6-next-protocol-udp alias ipv6-dip-decap-ip1 alias ipv6-dip-decap-ip2 alias ipv6-dip-decap-ip3 alias ipv6-dip-decap-ip4 alias udp-dport-gue-ip 2 permit any any ipv6 payload alias ipv6-next-protocol-udp alias ipv6-dip-decap-ip1 alias ipv6-dip-decap-ip2 alias ipv6-dip-decap-ip3 alias ipv6-dip-decap-ip4 alias udp-dport-gue-mpls 3 deny any any ipv6 payload alias ipv6-dip-decap-ip1 alias ipv6-dip-decap-ip2 alias ipv6-dip-decap-ip3 alias ipv6-dip-decap-ip4 4 permit any any
ACL to permit IP-in-IPv6 Decap Only The MAC ACL uses UDF to match on IP-in-IPv6 packets as follows: (a) IP next protocol = IPv4 (4) or IPv6 (41) (b) IPv6 DIP = IP-in-IP Decap IP (say 0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD - converted in hex) It allows IP-in-ip packets and drops all other packets to the IP-in-IP Decap IP. mac access-list payload alias ipv6-next-protocol-ipv4 offset 1 pattern 0x00000400 mask 0xffff00ff mac access-list payload alias ipv6-next-protocol-ipv6 offset 1 pattern 0x00002900 mask 0xffff00ff mac access-list payload alias ipv6-dip-decap-ip1 offset 6 pattern 0xAAAAAAAA mask 0 mac access-list payload alias ipv6-dip-decap-ip2 offset 7 pattern 0xBBBBBBBB mask 0 mac access-list payload alias ipv6-dip-decap-ip3 offset 8 pattern 0xCCCCCCCC mask 0 mac access-list payload alias ipv6-dip-decap-ip4 offset 9 pattern 0xDDDDDDDD mask 0 mac access-list foo counters per-entry 1 permit any any ipv6 payload alias ipv6-next-protocol-ipv4 alias ipv6-dip-decap-ip1 alias ipv6-dip-decap-ip2 alias ipv6-dip-decap-ip3 alias ipv6-dip-decap-ip4 2 permit any any ipv6 payload alias ipv6-next-protocol-ipv6 alias ipv6-dip-decap-ip1 alias ipv6-dip-decap-ip2 alias ipv6-dip-decap-ip3 alias ipv6-dip-decap-ip4 3 deny any any ipv6 payload alias ipv6-dip-decap-ip1 alias ipv6-dip-decap-ip2 alias ipv6-dip-decap-ip3 alias ipv6-dip-decap-ip4 4 permit any any 7280R3 Series, 7500R3 Series, and 7800R3 Series Mitigation involves using IPv6 PACLs to allow specific expected protocol packets and block all other traffic to the configured decap IPs. This requires the following TCAM profile update with the specified packet types: hardware tcam profile test feature acl port ipv6 packet ipv6 ipv4 forwarding routed decap packet ipv6 ipv6 forwarding routed decap packet ipv6 gue ipv4 forwarding routed decap packet ipv6 gue ipv6 forwarding routed decap packet ipv6 gue mpls forwarding mpls decap Note that introducing new packet types might also require specifying them under other features such as “acl vlan” or “qos ipv6”. Please reach out, if further assistance is needed with TCAM profile construction. ACL to Permit GUEv6 Only This IPv6 ACL matches on GUE packets as follows: (a) IP next protocol = UDP (0x11) (b) IP DIP = GUE Decap IP (c) UDP destination port = UDP port configured per payload (IP = Y or MPLS = Z) It allows GUE packets and drops all other packets to the GUE Decap IP. ipv6 access-list foo counters per-entry 1 permit udp any host eq Y 2 permit udp any host eq Z 3 deny ipv6 any host 4 permit ipv6 any any ACL to Permit IP-in-IPv6 Only This IPv6 ACL matches on IP-in-IPv6 packets as follows: (a) IP next protocol = IPv4 (4) or IPv6 (41) (b) IP DIP = IP-in-IP Decap IP It allows IP-in-IPv6 packets and drops all other packets to the IP-in-IPv6 Decap IP. ipv6 access-list foo counters per-entry 1 permit 4 any host 2 permit 41 any host 3 deny ipv6 any host 4 permit ipv6 any any
4. Проверьте следы эксплуатации
Проверьте аномальные входы, новые учётные записи, ошибки и необычные дочерние процессы в затронутом сервисе. Публичные проверенные правила обнаружения не включены в запись; отсутствие сигналов не доказывает отсутствие компрометации.
5. После исправления
- Проверьте фактическую версию и результат установки по бюллетеню.
- При необходимости перезапустите сервисы в согласованное окно.
- Повторите проверку сканером и функциональные проверки.
- Зафиксируйте результат, дату, владельца и оставшийся риск.
Продукты и затронутые версии
Arista Networks / EOS
{
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
}{
"status": "affected",
"version": "4.35.0",
"versionType": "custom",
"lessThanOrEqual": "4.35"
}{
"status": "affected",
"version": "4.34.0",
"versionType": "custom",
"lessThanOrEqual": "4.34"
}{
"status": "affected",
"version": "4.33.0",
"versionType": "custom",
"lessThanOrEqual": "4.33"
}{
"status": "affected",
"version": "4.32.0",
"versionType": "custom",
"lessThanOrEqual": "4.32"
}{
"status": "affected",
"version": "4.31.0",
"versionType": "custom",
"lessThanOrEqual": "4.31"
}{
"status": "affected",
"version": "*",
"versionType": "custom",
"lessThanOrEqual": "4.30"
}CVSS: оценки и векторы
CVSS 3.1 · cve5.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 4.0 · cve6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Источники и ссылки
Происхождение полей
{
"kev": {
"source": "kev",
"received_at": "2026-10-28T12:10:29.132557+00:00"
},
"cwes": [
"cve"
],
"epss": {
"source": "epss",
"received_at": "2026-11-03T21:15:15.991276+00:00"
},
"title": {
"source": "cve",
"received_at": "2026-10-28T17:27:25.443237+00:00"
},
"scores": [
"cve"
],
"status": {
"source": "cve",
"received_at": "2026-10-28T17:27:25.443237+00:00"
},
"kev_due": {
"source": "kev",
"received_at": "2026-10-28T12:10:29.132557+00:00"
},
"affected": [
"cve"
],
"kev_date": {
"source": "kev",
"received_at": "2026-10-28T12:10:29.132557+00:00"
},
"published": {
"source": "cve",
"received_at": "2026-10-28T17:27:25.443237+00:00"
},
"solutions": [
"cve"
],
"kev_action": {
"source": "kev",
"received_at": "2026-10-28T12:10:29.132557+00:00"
},
"percentile": {
"source": "epss",
"received_at": "2026-11-03T21:15:15.991276+00:00"
},
"references": [
"cve",
"kev"
],
"description": {
"source": "cve",
"received_at": "2026-10-28T17:27:25.443237+00:00"
},
"workarounds": [
"cve"
],
"configurations": []
}Хронология записи
- Данные обновлены04.11.2026, 00:15
- Данные обновлены03.11.2026, 00:14
- Данные обновлены02.11.2026, 00:12
- Данные обновлены31.10.2026, 11:59
- Опубликована28.10.2026, 20:27
- Данные обновлены28.10.2026, 18:06
- Добавлена в CISA KEV28.10.2026, 15:10
Личная заметка и статус
Другие CVE того же продукта
| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords Arista Networks / EOS | Средний | 6.0 | 0,13 % | 15.09.2026 | ||
| CVE-2025-3456 On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c Arista Networks / EOS | Низкий | 3.8 | 0,11 % | 25.08.2025 | ||
| CVE-2026-73443 On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef Arista Networks / EOS | Средний | 5.3 | 0,27 % | 16.09.2026 | ||
| CVE-2026-73442 On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for Arista Networks / EOS | Низкий | 2.1 | 0,21 % | 16.09.2026 | ||
| CVE-2026-73457 Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users. Arista Networks / EOS | Средний | 6.0 | 0,32 % | 16.09.2026 |