CVE-2026-7473: Arista EOS Incomplete Comparison Vulnerability Leading to Incorrect Packet Forwarding

Arista Extensible Operating System (EOS) is affected by CVE-2026-7473, a critical incomplete comparison with missing factors vulnerability. This flaw enables a compromised or malicious actor to craft specific tunneled packets that, when directed to a vulnerable Arista EOS switch, are incorrectly decapsulated and subsequently forwarded to unintended network destinations. The vulnerability arises when the switch's configured decapsulation IP matches the destination IP of such a specially crafted, unexpected tunneled packet. This misrouting can lead to severe consequences, including network segmentation bypass, unauthorized access to internal resources, or denial of service by disrupting legitimate traffic flows. CISA has added this CVE to its Known Exploited Vulnerabilities Catalog, indicating a significant risk and recommending immediate mitigation.

Attack Chain

1. Attacker Reconnaissance: An attacker identifies a publicly exposed Arista EOS switch configured to decapsulate tunneled traffic.
2. Decapsulation IP Identification: The attacker determines the switch's specific IP address configured for tunneled packet decapsulation, either through reconnaissance or prior knowledge.
3. Malformed Packet Crafting: The attacker creates a malformed or "unexpected" tunneled packet, leveraging the "incomplete comparison" vulnerability in Arista EOS.
4. Targeted Packet Destination: The crafted tunneled packet's destination IP is set to match the identified decapsulation IP of the vulnerable Arista EOS switch.
5. Packet Transmission: The attacker sends the specially crafted tunneled packet towards the vulnerable Arista EOS switch.
6. Incorrect Decapsulation: Due to CVE-2026-7473, the Arista EOS switch incorrectly decapsulates the unexpected tunneled packet, despite its malformed nature or unauthorized origin.
7. Unauthorized Forwarding: The switch then forwards the content of the improperly decapsulated packet according to its internal routing tables, directing it to an internal network segment or host it should not reach.
8. Impact Execution: The misforwarded traffic leads to unauthorized network access, data exfiltration, or a bypass of network security controls, achieving the attacker's objective.

Impact

Successful exploitation of CVE-2026-7473 can lead to significant network security breaches. The primary impact involves the bypassing of network segmentation and access controls, allowing an attacker to gain unauthorized access to internal, sensitive network segments, applications, or data that would typically be protected. This could facilitate data exfiltration, lateral movement, or the establishment of persistent access within the compromised network. Furthermore, incorrect packet forwarding can disrupt legitimate network operations, potentially leading to denial-of-service conditions or network instability. While specific victim counts are not publicly available, the inclusion in CISA's KEV catalog underscores its critical risk to organizations utilizing Arista EOS.

Recommendation

• Apply mitigations outlined in the Arista security advisory (https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137) immediately.
• Deploy the Sigma rules "Detects CVE-2026-7473 exploitation - Anomalous Internal Network Flow After Arista EOS" and "Detects CVE-2026-7473 exploitation - Suspicious Tunneled Traffic Targeting Arista Decapsulation IP (Non-Legitimate Source)" to your SIEM for detection of exploitation attempts and successful breaches.
• Ensure comprehensive network logging is enabled on all Arista EOS devices and adjacent firewall/network monitoring solutions to capture detailed traffic flow and decapsulation events.
• Review and enforce network segmentation policies to minimize the blast radius should a vulnerability like CVE-2026-7473 be exploited, as per BOD 22-01 guidance.