CVE-2026-73453

Executive Summary

CVE-2026-73453 is a critical (CVSS 10.0) remote code execution vulnerability in Arista EOS when configured with P4Runtime, a programmable data-plane interface. An unauthenticated, network-positioned attacker who can reach the P4Runtime service can craft a malicious packet during P4Runtime session initiation and obtain complete administrative control over the affected switch. P4Runtime is disabled by default, so exposure is limited to environments where the feature has been explicitly enabled and is network-reachable — but where present, the blast radius is total device compromise.

Technical Analysis

P4Runtime is an open standard ("Programming Protocol-Independent Packet Processors Runtime") used to program the forwarding behavior of a P4-capable data plane, typically via a gRPC-based session between a controller and the switch. On Arista EOS, P4Runtime is an opt-in feature that is off by default; when enabled, the switch exposes a P4Runtime service endpoint that accepts session-initiation traffic.

CVE-2026-73453 is classified under CWE-94 (Improper Control of Generation of Code — "Code Injection"). Per the NVD description, the vulnerability is triggered during initiation of a P4Runtime session: an unauthenticated client that crafts a malicious packet in this phase can cause code to be executed on the switch under certain conditions. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms: remotely reachable, low attack complexity, no credentials, no user interaction, changed scope, and high confidentiality/integrity/availability impact.

Critical accuracy note: the NVD description does not disclose which specific P4Runtime message field, protobuf element, or code path is at fault, nor the underlying memory-safety or injection primitive. No function names, endpoints, or parameters beyond "P4Runtime session initiation" are provided, so the code-level mechanism cannot be stated with confidence. The defensible characterization is: a pre-authentication code-injection flaw in the P4Runtime session-handshake handling path, exploited by a purpose-crafted session-initiation packet.

Because the P4Runtime surface is a programmable interface designed to load control-plane logic, successful injection yields code execution in the switch process context — which is why impact is full administrative control rather than a simple DoS.

The CVSS "Scope: Changed" (S:C) flag is significant: the vulnerable component (P4Runtime handler) is compromised in a way that affects resources beyond its own security authority — the entire EOS control plane and device administration. This is consistent with a container/process breakout or privileged daemon compromise rather than an isolated service crash.

Exploitation Scenarios

Public PoC/exploit code is not available (PoC_STATUS: None), and the vendor states it is not aware of exploitation in customer networks. The chain below is inferred strictly from the NVD description and the CWE-94 class; it deliberately avoids inventing specific functions, packets fields, or endpoints.

1. Reconnaissance / target identification. The attacker identifies Arista EOS devices with P4Runtime enabled and reachable. Because P4Runtime is disabled by default, this is the primary gating factor. Reconnaissance would target the network services associated with P4Runtime session handling on the management/reachability plane of affected switches (per the advisory, the exposure depends on "affected platforms running Arista EOS configured with P4Runtime").

2. Triggering the flaw class. The attacker acts as an unauthenticated P4Runtime client and initiates a session. During session initiation, the attacker supplies a maliciously crafted packet. Per the description, this crafted packet triggers the code-injection condition (CWE-94) — i.e., attacker-controlled input reaches a code-generation/execution site without adequate validation. No authentication is required (PR:N), and no user action is needed (UI:N).

3. Payload/execution method. At the vulnerability-class level, a code-injection flaw means attacker-supplied data influences executable logic rather than being treated as inert data. The result described by the vendor is arbitrary code execution "under certain conditions." The specific input syntax and execution primitive are not published, so no byte-level payload can be defined. No public PoC exists; the exact trigger must be treated as unpublished.

4. Post-exploitation impact. Successful exploitation grants "complete administrative control over the compromised switch." From a network device of this class, an attacker with full admin control can manipulate routing/forwarding behavior, intercept or redirect traffic, modify ACLs, disable logging, and pivot deeper into the network fabric. The S:C scope change means the compromise extends beyond the P4Runtime service itself to the whole device trust boundary.

Impact Assessment

• CVSS: 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
• Confidentiality/Integrity/Availability: all High (C:H/I:H/A:H). Full device compromise enables traffic disclosure, configuration/forwarding manipulation, and denial of service.
• Scope: Changed (S:C) — impact crosses a security boundary, consistent with control-plane takeover.
• Affected systems: Arista EOS platforms configured with P4Runtime. Not affected: default EOS deployments where P4Runtime is disabled (the vendor explicitly notes P4Runtime is off by default).
• Blast radius: In data-center and service-provider fabrics, a compromised leaf/spine switch can degrade or poison large segments of the network. The business impact is potentially severe but is conditional on P4Runtime being enabled and reachable.
• EPSS: not yet scored by FIRST.org — no probability estimate available. Do not assume low likelihood; treat as unpatched critical pending vendor guidance.
• CISA KEV: Not listed.
• Exploitability in the wild: No known malicious exploitation per the vendor; no public PoC, no Nuclei template, no exploit code tracked.

Detection Guidance

Detection must focus on anomalous P4Runtime session-initiation traffic and abnormal switch process behavior. Because exact trigger bytes are unpublished, rules below target the protocol surface and post-exploitation behavioral signals (unexpected admin actions, process/command execution on the switch) rather than a precise exploit signature. Network rules are illustrative and should be tuned to your P4Runtime transport (typically gRPC/TLS) and port assignments.

Sigma Rule

title: Suspicious P4Runtime Session Initiation Against Arista EOS
id: 8f4e2c1a-7345-4b6e-9c0d-arista-p4runtime-0001
status: experimental
description: Detects anomalous or unauthenticated P4Runtime session-initiation activity targeting Arista EOS switches, relevant to CVE-2026-73453.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73453
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: firewall
detection:
  selection_dst_port:
    dst_port:
      - 9559   # common P4Runtime default; verify in your environment
      - 50051  # common gRPC port; verify in your environment
  selection_action:
    action: allowed
  selection_identity:
    src_ip|cidr: '0.0.0.0/0'
  filter_known_controllers:
    src_ip:
      - '10.0.0.0/8'   # example: replace with authorized P4Runtime controller subnets
  condition: selection_dst_port and selection_action and not filter_known_controllers
falsepositives:
  - Authorized SDN controllers outside the expected management subnet
level: high
tags:
  - attack.t1190
  - cve.2026.73453

YARA Rule

rule CVE_2026_73453_P4Runtime_CodeInjection_Indicators
{
    meta:
        author = "valtersit.com"
        description = "Heuristic indicators for P4Runtime session-initiation abuse related to CVE-2026-73453 (Arista EOS). No public PoC; non-specific."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73453"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $p4a = "P4Runtime" ascii wide nocase
        $p4b = "p4runtime" ascii wide
        $sess1 = "session" ascii wide nocase
        $init1 = "InitiateSession" ascii wide
        $grpc1 = "grpc" ascii wide nocase

    condition:
        uint16be(0) == 0x0000 or true
        and filesize < 10MB
        and (($p4a or $p4b) and $sess1 and ($init1 or $grpc1))
}

Note: No exploit artifact or malware sample exists for this CVE. This rule is a low-fidelity indicator to flag P4Runtime/session-string-bearing files or pcaps for analyst review — it is NOT a precise signature.

Suricata IDS Rule

alert tcp any any -> $HOME_NET 9559 (msg:"CVE-2026-73453 Possible Unauthenticated P4Runtime Session Initiation (Arista EOS)"; flow:to_server,established; content:"|00 00|"; depth:2; threshold:type limit, track by_src, seconds 60, count 5; classtype:attempted-admin; reference:cve,2026-73453; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73453; sid:90073453; rev:1;)

Deploy against the P4Runtime/gRPC port used in your environment (9559/50051 shown as examples). Tune threshold to reduce noise from legitimate controllers and adjust content to your transport.

Elastic Detection

network where destination.port in (9559, 50051)
  and event.action == "network_flow"
  and source.ip != "10.0.0.0/8"   // authorized P4Runtime controller range (example)
  and process.name != "p4runtime-controller"

Goal: surface network connections to the P4Runtime service from unexpected sources. If your telemetry normalizes eBPF/flow data with a protocol field, add and network.transport == "tcp". Supplement with EDR signals on the switch management host (unexpected process spawn) where available.

Splunk SPL Query

index=network (dest_port=9559 OR dest_port=50051)
| where NOT cidrmatch("10.0.0.0/8", src_ip)
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by dest_ip dest_port
| where count > 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Adjust the CIDR to your authorized P4Runtime controller ranges and the ports to your deployment. Companion query for admin-action anomalies:

index=eos_logs (process=p4runtime OR message="*P4Runtime*")
| stats count values(message) by host, user
| sort - count

Wazuh OSSEC Rule

<group name="arista,p4runtime,cve-2026-73453,">
  <rule id="100734" level="12">
    <decoded_as>json</decoded_as>
    <field name="dst_port">9559|50051</field>
    <field name="action">allowed</field>
    <description>CVE-2026-73453: Unexpected P4Runtime service connection on Arista EOS (possible unauthenticated session initiation)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73453,</group>
  </rule>

  <rule id="100735" level="13">
    <if_sid>100734</if_sid>
    <field name="src_ip">!10\.</field>
    <description>CVE-2026-73453: P4Runtime session attempt from non-management source; investigate for exploitation</description>
    <group>cve_2026_73453,</group>
  </rule>
</group>

Requires switch/firewall logs to be ingested and decoded (e.g., JSON flow or syslog). Tune the source-IP filter to your environment and enrich with a lookup of authorized controllers.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is present in the provided data. The following guidance is derived from the vendor's own disclosure (P4Runtime disabled by default) and standard hardening practice; it is NOT a substitute for a vendor advisory.

1. Immediate mitigations

   • Disable P4Runtime where it is not operationally required. The vendor states P4Runtime is disabled by default in EOS; the single most effective mitigation is to confirm it is disabled on all devices that do not need it.
   • Restrict network reachability. For devices where P4Runtime must remain enabled, restrict access to the P4Runtime service to a minimal set of authorized controller IPs via management-plane ACLs/firewalls. Do not expose it to untrusted network segments.
   • Segment the management/programmable plane from the production data plane and from general user networks.
   • Monitor for unauthenticated session-initiation attempts (see Detection Guidance) until a fix is available.

2. Patch / upgrade steps

   • No fixed version is published in the available data. Monitor the Arista security advisory portal and your support channel for an updated EOS release addressing CVE-2026-73453, and apply it promptly once available.
   • Until a fix lands, treat affected, reachable devices as high-priority risk and apply the mitigations above.

3. Long-term hardening

   • Maintain an inventory of exactly which switches have P4Runtime enabled, and review that list on a schedule; default-off features should stay off unless justified.
   • Enforce management-plane segmentation and least-privilege access to programmable interfaces.
   • Ingest switch logs into the SIEM and alert on P4Runtime/administrative anomalies.
   • Track the CVE in your vulnerability management program given the 10.0 CVSS score, and re-evaluate EPSS once FIRST.org scores it.

References

• NVD — CVE-2026-73453: https://nvd.nist.gov/vuln/detail/CVE-2026-73453
• Arista Security Advisories portal (vendor advisory — consult directly for the authoritative advisory and any fixed release): https://www.arista.com/en/support/advisories-notices
• CWE-94 — Improper Control of Generation of Code ("Code Injection"): https://cwe.mitre.org/data/definitions/94.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST.org EPSS (not yet scored for this CVE at time of writing): https://www.first.org/epss/

Exploitation-in-the-wild status: The vendor states it is not aware of malicious exploitation in customer networks. No public PoC, exploit code, or Nuclei template exists, and CVE-2026-73453 is not in CISA KEV. No threat-actor campaign is associated with this CVE in the data provided.