CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass

README.md markdown CVE-2026-7473 - Arista EOS Tunnel Decapsulation Bypass ⚠️ WARNING This code is ONLY for educational purposes and authorized security testing. 📋 Description CVE-2026-7473 is a vulnerability in Arista EOS where a switch configured as a tunnel endpoint VXLAN, GRE, decap-groups...

CVE-2026-121370

On affected platforms running Arista EOS with Precision Time Protocol PTP configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service DoS condition by sending traffic to the system...

CVE-2026-121371

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem...

CVE-2026-121369

On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot...

CVE-2026-121368

On affected platforms running Arista EOS with Bidirectional Forwarding Detection BFD configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency direct or multi-hop to a BFD-enabled interface can send a specially crafted BFD packet resulting in a...

CVE-2026-121294

On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit PDU that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts...

CVE-2026-121295

On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot...

CVE-2026-121293

On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol BGP peer can send a crafted BGP message over an established session with the Dynamic Path Selection DPS address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessio...

CVE-2026-121367

On affected Arista EOS platforms with Routing Information Protocol version 2 RIPv2 configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent networ...

CVE-2026-121290

On affected platforms running Arista EOS with Border Gateway Protocol BGP changing the BGP listen port from its default value disables default protective Access Control List ACL rules against unexpected BGP peering attempts...

CVE-2026-121289

On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing...

CVE-2026-121292

A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging...

CVE-2026-121291

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates...

CVE-2026-120981

On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers...

CVE-2026-120983

On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing PBR, traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hos...

CVE-2026-121286

On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering SR-TE address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device...

CVE-2026-120980

On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly...

CVE-2026-120982

On affected platforms running Arista EOS with Border Gateway Protocol BGP configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to...

CVE-2026-120976

On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade SSU. An attacker with administrative access on the device who obtains the...

CVE-2026-120975

On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority CA certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed...