On affected Arista EOS platforms with DHCP relay configured, the relay agent does not properly verify the authenticity of DHCP reply packets. Specifically, it forwards DHCP replies from IP addresses not configured as helper addresses without validation. This flaw allows an unauthenticated attacker with network access to supply malicious network configuration parameters to clients, which could result in traffic interception or denial of service. The vulnerability affects versions >=4.33.0 <4.33.10M, >=4.34.0 <4.34.8M, >=4.35.0 <4.35.6M, and >=4.36.0 <4.36.2F. The CVSS 3.1 base score is 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting critical impact on confidentiality, integrity, and availability.

An attacker with network access but no authentication can exploit this vulnerability to send malicious DHCP reply packets that the relay agent forwards to clients. This can cause clients to receive incorrect network configuration parameters, enabling traffic interception or denial of service. The impact affects confidentiality, integrity, and availability of client network communications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict network access to trusted devices and monitor DHCP relay configurations carefully to limit exposure.