Riskcovery

CVE-2026-73443

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef

State
Published
Severity
5.3 Medium
Published
Sep 16, 2026
Updated
Sep 17, 2026
Reserved
Aug 12, 2026

Read the record on cve.org

Description

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NArista
3.14.7 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LArista

Weaknesses

  • CWE-294 Authentication Bypass by Capture-replay

Affected Products

ProductVersions
EOSArista Networks
  • 4.36.0 through 4.36.1FAffectedfrom 4.36.2FNot affected
  • 4.35.0 through 4.35.5MAffectedfrom 4.35.6MNot affected
  • 4.34.0 through 4.34.7MAffectedfrom 4.34.8MNot affected
  • 4.33.0 through 4.33.9MAffectedfrom 4.33.10MNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.