Back to overview

CVE-2026-7473

MEDIUM KEV CISA Exploitation: ACTIVE
5.8
CVSS 3.1
Description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Metadata

CVE ID
CVE-2026-7473
State
PUBLISHED
Assigner
Arista
Reserved
2026-04-29 20:08 UTC
Published
2026-06-05 16:22 UTC
Last updated
2026-06-10 03:57 UTC
Primary CWE
CWE-1023
CWE-1023: Incomplete Comparison with Missing Factors
Vendor / Product
Arista Networks / EOS
Sources
cve.org  ·  NVD

Severity & Metrics

5.8 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
yes
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Vendor
Arista
Product
Extensible Operating System
Added to KEV
2026-06-09
Due date
2026-06-23
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA description
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
Affected products (1)
VendorProductPlatformVersions
Arista Networks EOS 7020R Series,7280R/R2 Series,7500R/R2 Series,7280R3 Series (Limited exposure: IP-in-IPv6 and GUEv6),7500R3 Series (Limited exposure: IP-in-IPv6 and GUEv6),7800R3 Series (Limited exposure: IP-in-IPv6 and GUEv6) 4.36.0, 4.35.0 ≤ 4.35, 4.34.0 ≤ 4.34, 4.33.0 ≤ 4.33 …
Weakness (CWE)
CWESourceDescription
CWE-1023 cna CWE-1023: Incomplete Comparison with Missing Factors
CVSS scores (2)
ScoreSeverityVersionSourceVector
6.9 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
5.8 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
References (1)
Back to overview