CVE-2026-73443: CWE-294 Authentication Bypass by Capture-replay in Arista Networks EOS
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.
AI Analysis
Technical Summary
This vulnerability affects Arista EOS platforms running VRRPv2 with IP-AH authentication configured. An attacker within the same layer 2 segment can capture a legitimate VRRP advertisement and replay it repeatedly. The replayed advertisements can advertise stale VRRP state, which may prevent backup routers from assuming control of the virtual gateway when the master router goes down. This leads to a denial of service condition for hosts using the virtual gateway address. The CVSS 3.1 base score is 4.7 (medium severity), reflecting the local attack vector, no privileges required, no user interaction, and impact limited to availability.
Potential Impact
The impact is a denial of service for hosts relying on the virtual gateway address managed by VRRP. The attacker can prevent failover by replaying stale VRRP advertisements, causing backup routers to not take over when the master router fails. There is no confidentiality or integrity impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, network segmentation to restrict attacker access to the VRRP layer 2 segment may reduce risk.
CVE-2026-73443: CWE-294 Authentication Bypass by Capture-replay in Arista Networks EOS
Description
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.
CVSS v3.1
Score 4.7medium
Affected software
Arista Networks
EOS
pkg:rpm/arista/eosRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Arista EOS platforms running VRRPv2 with IP-AH authentication configured. An attacker within the same layer 2 segment can capture a legitimate VRRP advertisement and replay it repeatedly. The replayed advertisements can advertise stale VRRP state, which may prevent backup routers from assuming control of the virtual gateway when the master router goes down. This leads to a denial of service condition for hosts using the virtual gateway address. The CVSS 3.1 base score is 4.7 (medium severity), reflecting the local attack vector, no privileges required, no user interaction, and impact limited to availability.
Potential Impact
The impact is a denial of service for hosts relying on the virtual gateway address managed by VRRP. The attacker can prevent failover by replaying stale VRRP advertisements, causing backup routers to not take over when the master router fails. There is no confidentiality or integrity impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, network segmentation to restrict attacker access to the VRRP layer 2 segment may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Arista
- Date Reserved
- 2026-08-12T16:39:35.977Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaae7b555bf5e2cf5087546
Added to database: 09/16/2026, 19:02:13 UTC
Last enriched: 09/16/2026, 19:17:39 UTC
Last updated: 09/17/2026, 03:25:53 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.