CVE-2026-73437

Summary

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.

Affected Software

Weaknesses

• CWE-345: CWE-345 Insufficient Verification of Data Authenticity

Workarounds

IP locking can be run in a locked address enforcement disabled state, along with the DHCP Relay, to provide protection against rogue DHCP servers and spoofing. This is supported on DHCPv4 starting with EOS-4.29.0F and on DHCPv6 starting with EOS-4.27.0F. For more information, see IP Locking https://www.arista.com/en/support/toi/eos-4-25-1f/14628-ip-locking-release-updates .

This is compatible with the following platforms only:

• CCS-720XP
• CCS-710P
• CCS-720DP
• CCS-722XPM
• DCS-7010TX
• DCS-7050CX3
• DCS-7050SX3
• CCS-710XP
• CCS-720DF
• CCS-720DT
• CCS-720XDM
• CCS-720XPM
• CCS-755
• CCS-758
• DCS-7050CX3M
• DCS-7050TX3
• DCS-7304
• DCS-7308
• 7300X3

Untrusted ports can be locked with the following configuration:

switch(config)# address locking switch(config-address-locking)# locked-address ipv4 enforcement disabled switch(config-address-locking)# locked-address ipv6 enforcement disabled

switch(config)# int et 5 switch(config-if-Et5)# address locking ?   ipv4  Enable address locking for IPv4   ipv6  Enable address locking for IPv6   <cr> switch(config-if-Et5)# address locking ipv4 switch(config-if-Et5)# address locking ipv6

The above configuration can be validated using the following output:

switch# show address locking IP Locking is active Logging events: None Bindings persistence is enabled Bindings last backup time: Not Available Configured IPv4 Interfaces:       Et5 Configured IPv6 Interfaces:       Et5 Configured IPv4 VLANs: Configured IPv6 VLANs:

Interface Status Interface        IPv4       IPv6

Ethernet5        yes*       yes*

• Locked address enforcement is disabled

With the above configuration applied, DHCP traffic from untrusted ports can be blocked and the following output reflects the packet drops:

switch#show address locking counters detail Action                            Count

ARP (0.0.0.0) PERMIT                  0 DHCP from client to server PERMIT     0 DHCP from server DROP                 4

In releases prior to EOS-4.35.0F, “show address locking counters detail” command is not available. Instead, run “show platform trident tcam detail” and grep for these IP Locking counters.

switch#show platform trident tcam detail === TCAM detail for switch Linecard0/0 === Groups programmed in IFP … TCAM group 129 copy 0 in PIPE 0 uses 3 entries and can use up to 12282 more.   IP Locking v4 uses 3 entries.     0x0000005c            0 hits - Unknown ARP permit rule     0x0000005d            0 hits - DHCP permit from client     0x00000060            4 hits - DHCP drop from server TCAM group 129 copy 1 in PIPE 0 uses 3 entries and can use up to 12282 more.   IP Locking v4 uses 3 entries.     0x0800005c            0 hits - Unknown ARP permit rule     0x0800005d            0 hits - DHCP permit from client     0x08000060            0 hits - DHCP drop from server

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156

• ←Previous
• Next→