CVE-2026-73444
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Summary
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Arista Networks | EOS | 4.36.0 <= 4.36.1F | affected |
| Arista Networks | EOS | 4.35.0 <= 4.35.5M | affected |
| Arista Networks | EOS | 4.34.0 <= 4.34.7M | affected |
| Arista Networks | EOS | 4.33.0 <= 4.33.9M | affected |
| Arista Networks | EOS | 0 | affected |
Weaknesses
- CWE-303: CWE-303 Incorrect Implementation of Authentication Algorithm
Workarounds
Restricting physical and logical access to VRRP-enabled segments reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path:
switch(config)# interface vlan 20 switch(config-if-vl20)# vrrp 1 ipv4 version 3
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.