Attack Chain

1. Attacker Reconnaissance: An attacker identifies a publicly exposed Arista EOS switch configured to decapsulate tunneled traffic.
2. Decapsulation IP Identification: The attacker determines the switch's specific IP address configured for tunneled packet decapsulation, either through reconnaissance or prior knowledge.
3. Malformed Packet Crafting: The attacker creates a malformed or "unexpected" tunneled packet, leveraging the "incomplete comparison" vulnerability in Arista EOS.
4. Targeted Packet Destination: The crafted tunneled packet's destination IP is set to match the identified decapsulation IP of the vulnerable Arista EOS switch.
5. Packet Transmission: The attacker sends the specially crafted tunneled packet towards the vulnerable Arista EOS switch.
6. Incorrect Decapsulation: Due to CVE-2026-7473, the Arista EOS switch incorrectly decapsulates the unexpected tunneled packet, despite its malformed nature or unauthorized origin.
7. Unauthorized Forwarding: The switch then forwards the content of the improperly decapsulated packet according to its internal routing tables, directing it to an internal network segment or host it should not reach.
8. Impact Execution: The misforwarded traffic leads to unauthorized network access, data exfiltration, or a bypass of network security controls, achieving the attacker's objective.

Impact

Successful exploitation of CVE-2026-7473 can lead to significant network security breaches. The primary impact involves the bypassing of network segmentation and access controls, allowing an attacker to gain unauthorized access to internal, sensitive network segments, applications, or data that would typically be protected. This could facilitate data exfiltration, lateral movement, or the establishment of persistent access within the compromised network. Furthermore, incorrect packet forwarding can disrupt legitimate network operations, potentially leading to denial-of-service conditions or network instability. While specific victim counts are not publicly available, the inclusion in CISA's KEV catalog underscores its critical risk to organizations utilizing Arista EOS.

Recommendation

• Apply mitigations outlined in the Arista security advisory (https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137) immediately.
• Deploy the Sigma rules "Detects CVE-2026-7473 exploitation - Anomalous Internal Network Flow After Arista EOS" and "Detects CVE-2026-7473 exploitation - Suspicious Tunneled Traffic Targeting Arista Decapsulation IP (Non-Legitimate Source)" to your SIEM for detection of exploitation attempts and successful breaches.
• Ensure comprehensive network logging is enabled on all Arista EOS devices and adjacent firewall/network monitoring solutions to capture detailed traffic flow and decapsulation events.
• Review and enforce network segmentation policies to minimize the blast radius should a vulnerability like CVE-2026-7473 be exploited, as per BOD 22-01 guidance.