VULNERABILITY INTELLIGENCE

CVE-2026-7473

CVSS score5.8 MEDIUM
EPSS probability1.11%
CISA KEVKnown exploited vulnerability
Published2026-06-05
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Known Exploited Vulnerability

Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Vendor / product: Arista / Extensible Operating System

Description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Weakness classification

  • psirt@arista.com: CWE-1023

Primary references