Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-7473

Опубликовано: 05 июн. 2026
Источник: nvd
CVSS3: 5.8
EPSS Низкий

Описание

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.

This issue has been reported as being exploited in the wild.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*

Одно из

cpe:2.3:h:arista:7020sr-24c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020sr-32c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020srg-24c2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020tr-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7020tra-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr-48:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2a-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2a-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2k-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2k-60:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr2m-30:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-32d4:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-32p4:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-36s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3-96:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3a-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3ak-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-24d12:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-48d6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3am-72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3mk-32d4s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280cr3mk-32p4s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3-24:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3a-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3a-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3ak-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3ak-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3am-36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280dr3am-54:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280pr3-24:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c36:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c36-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qr-c72:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qra-c36s:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280qra-c36sm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2-48yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2-48yc6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2a-48yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2a-48yc6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr2k-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3-40yc6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3-48yc8:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sr3m-48yc8:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sra-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sra-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280sram-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280srm-40cx2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tr-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tr3-40c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tra-48c6:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7280tra-48c6-m:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3a-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3ak-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7289r3am-sc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-36q-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-48s2cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r-8cfpx-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2a-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2ak-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2ak-48ycq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2am-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r2m-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-24d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-24p:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3-36cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3k-36cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500r3k-48y4d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7500rm-36cq-lc:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7504r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7504r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7508r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7508r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7512r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7512r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516-sup2:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516n-ch:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7516r-fm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3-36d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3-48cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36d:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36dm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36p:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3a-36pm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3ak-36dm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3ak-36pm:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-48cq:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-48cqms:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7800r3k-72y:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7804r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7808r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7812r3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7816lr3:-:*:*:*:*:*:*:*
cpe:2.3:h:arista:7816r3:-:*:*:*:*:*:*:*

EPSS

Процентиль: 53%
0.00836
Низкий

5.8 Medium

CVSS3

Дефекты

CWE-1023

Связанные уязвимости

github логотип

GHSA-mcx4-vm6v-r473

CVSS3: 5.8
github
2 месяца назад

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

fstec логотип

BDU:2026-08086

CVSS3: 5.8
fstec
3 месяца назад

Уязвимость конфигурации декапсуляции VXLAN (Virtual Extensible LAN) и GRE (Generic Routing Encapsulation) операционной системы Arista EOS, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

EPSS

Процентиль: 53%
0.00836
Низкий

5.8 Medium

CVSS3

Дефекты

CWE-1023