CVE-2026-73450
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Summary
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Arista Networks | EOS | 4.36.0 <= 4.36.1F | affected |
| Arista Networks | EOS | 4.35.0 <= 4.35.5M | affected |
| Arista Networks | EOS | 4.34.0 <= 4.34.7.1M | affected |
| Arista Networks | EOS | 4.33.0 <= 4.33.9M | affected |
| Arista Networks | EOS | 0.0.0 < 4.33.0 | affected |
Weaknesses
- CWE-345: CWE-345: Insufficient Verification of Data Authenticity
Workarounds
Restrict access to the MLAG heartbeat interface by configuring Access Control Lists (ACLs) to permit traffic strictly from the designated peer address.
Insert the following ACL rules into the top of the ingress ACL on the VRF where the heartbeat address is configured, while denying traffic from all other source addresses.
permit udp host <heartbeatPeerAddress> any eq mlag permit udp any any eq mlag ttl eq 255 deny udp any any eq mlag log
Ensure administrative access for required services (e.g., SSH, NTP, SNMP) remains permitted.
For instance, if the heartbeat address is reachable via the management VRF. First, construct the ingress ACL to restrict access on the MLAG heartbeat interface.
switch(config)#ip access-list MLAG-HEARTBEAT-PROTECT switch(config-acl-MLAG-HEARTBEAT-PROTECT)#5 permit udp host 172.30.118.190 any eq mlag switch(config-acl-MLAG-HEARTBEAT-PROTECT)#6 permit udp any any eq mlag ttl eq 255 switch(config-acl-MLAG-HEARTBEAT-PROTECT)#7 deny udp any any eq mlag log …
Apply the ACL to management VRF:
switch(config)#system control-plane switch(config-system-cp)#ip access-group MLAG-HEARTBEAT-PROTECT vrf management in switch(config-system-cp)#exit
Show command to confirm the rules:
switch(config)#show ip access-lists MLAG-HEARTBEAT-PROTECT Phone ACL bypass: disabled IP Access List MLAG-HEARTBEAT-PROTECT 5 permit udp host 172.30.118.190 any eq mlag 6 permit udp any any eq mlag ttl eq 255 7 deny udp any any eq mlag log …
Total rules configured: … Configured on Ingress: control-plane(management VRF) Active on Ingress: control-plane(management VRF)
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.