On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef
Summary
| CVE | CVE-2026-73443 |
|---|---|
| State | PUBLISHED |
| Assigner | Arista |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-16 19:17:31 UTC |
| Updated | 2026-09-17 19:16:57 UTC |
| Description | On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address. |
Risk And Classification
Primary CVSS: v4.0 5.3 MEDIUM from [email protected]
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002730000 probability, percentile 0.199400000 (date 2026-09-20)
Problem Types: CWE-294 | CWE-294 CWE-294 Authentication Bypass by Capture-replay
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 5.3 | MEDIUM | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 4.7 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L |
| 3.1 | CNA | CVSS | 4.7 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L |
CVSS v4.0 Breakdown
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Arista Networks | EOS | affected 4.36.0 4.36.1F custom | 710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance |
| CNA | Arista Networks | EOS | affected 4.35.0 4.35.5M custom | 710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance |
| CNA | Arista Networks | EOS | affected 4.34.0 4.34.7M custom | 710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance |
| CNA | Arista Networks | EOS | affected 4.33.0 4.33.9M custom | 710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.arista.com/en/support/advisories-notices/security-advisory/24713-securit... | [email protected] | www.arista.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Important: Upgrading alone is not sufficient. The replay protection introduced by the fix is disabled by default and must be explicitly enabled with the following new global configuration command after upgrading to a remediated release: switch(config)#vrrp ipv4 authentication anti-replay CVE-2026-73443 has been fixed in the following releases: * 4.36.2F and later releases in the 4.36.x train * 4.35.6M and later releases in the 4.35.x train * 4.34.8M and later releases in the 4.34.x train * 4.33.10M and later releases in the 4.33.x train
Workarounds
CNA: Exposure is limited to attackers with access to the layer 2 network segment on which VRRP is running. Restricting physical and logical access to VRRP-enabled segments (for example with port security and by not extending VRRP VLANs to untrusted access ports) reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path. The below configuration shows how to configure VRRPv3 on VLAN 20: switch(config)# interface vlan 20 switch(config-if-vl20)# vrrp 1 ipv4 version 3