CVE-2026-73451

Summary

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior.

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Affected Software

Weaknesses

• CWE-1419: CWE-1419 Incorrect Initialization of Resource

Workarounds

The workaround is to re-configure (remove and reapply) the ingress IPv4 and IPv6 ACLs applied to all SVIs.

For every SVI check the active ACL(s) applied to it,

switch(config)# interface VlanNNN switch(config-if-VlNNN)# show active

Then remove the ACL(s) and re-apply them,

switch(config-if-VlNNN)# no ip access-group <acl name> in switch(config-if-VlNNN)# ip access-group <acl name> in switch(config-if-VlNNN)# no ipv6 access-group <acl name> in switch(config-if-VlNNN)# ipv6 access-group <acl name> in

Note: the security provided by the ACL configuration will not be present during the removal/reapplication of the security ACLs.

For more information about Security ACLs see EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24707-security-advisory-0151

• ←Previous
• Next→