CVE-2026-7473

Executive Summary

CVE-2026-7473 is a critical vulnerability in Arista EOS affecting platforms with tunnel decapsulation configurations (VXLAN, GRE, or decap-groups). The flaw allows an unauthenticated, remote attacker to send crafted tunneled packets that are incorrectly decapsulated and forwarded by the switch, bypassing protocol type verification. This can lead to unauthorized traffic processing, potential network segmentation bypass, and information disclosure. The vulnerability is actively exploited in the wild, with no patch currently available. The CVSS score is 5.8 (Medium), but the active exploitation and lack of patch elevate the risk.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a network infrastructure vulnerability in Arista EOS, a proprietary operating system for Arista switches. No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Base Score: 5.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High due to active exploitation in the wild and no available patch. The low EPSS score (0.0%) may indicate limited scanning, but manual exploitation is confirmed.

Deep Dive & Mechanics

The vulnerability resides in the tunnel decapsulation logic of Arista EOS. When a switch is configured with a tunnel decapsulation interface (e.g., VXLAN, GRE, or decap-group), it listens for packets destined to the configured decapsulation IP. The flaw is that the switch does not verify the tunnel protocol type (e.g., VXLAN vs. GRE) before processing the packet. An attacker can send a tunneled packet with a destination IP matching the configured decapsulation IP, but using a different tunnel protocol than expected. The switch will incorrectly decapsulate and forward this packet, potentially allowing traffic that should be blocked or isolated.

Root Cause: Missing protocol type validation in the tunnel decapsulation routine. The switch trusts the outer IP header and proceeds with decapsulation without checking if the inner protocol matches the configured tunnel type.

Impact:

• Unauthorized traffic injection into internal networks.
• Bypass of network segmentation and access controls.
• Potential for lateral movement and data exfiltration.

Vulnerable vs. Patched Code

Since no patch is available, a code comparison is not possible. However, the vulnerable behavior can be described:

Vulnerable Logic (Pseudocode):

if (packet.dest_ip == decap_ip) {
    // No protocol type check
    decapsulate_and_forward(packet);
}

Patched Logic (Expected):

if (packet.dest_ip == decap_ip && packet.protocol == expected_tunnel_type) {
    decapsulate_and_forward(packet);
} else {
    drop_packet(packet);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the network where the target Arista switch is reachable.
• Knowledge of the configured decapsulation IP (can be discovered via network scanning or reconnaissance).

Exploitation Steps:

1. Identify the target switch's decapsulation IP (e.g., via SNMP, LLDP, or passive monitoring).
2. Craft a tunneled packet with:
   • Outer IP destination = decapsulation IP
   • Tunnel protocol = any (e.g., GRE, VXLAN, or custom)
   • Inner payload = desired traffic (e.g., ICMP, TCP)
3. Send the packet to the switch.
4. Observe that the switch decapsulates and forwards the inner packet, potentially to an internal network.

Example using Scapy (Python):

from scapy.all import *

# Craft a GRE packet with destination IP matching decapsulation IP
ip = IP(src="192.168.1.100", dst="10.0.0.1")
gre = GRE()
inner_ip = IP(src="10.0.0.2", dst="10.0.0.3")
payload = ICMP()
packet = ip/gre/inner_ip/payload
send(packet)

Blue Team

Detection:

• Monitor for unexpected tunnel protocol types on decapsulation interfaces.
• Use network flow analysis to detect anomalous decapsulation events.
• Implement strict ACLs to limit which sources can send tunneled packets to decapsulation IPs.

Mitigation:

• Disable tunnel decapsulation if not required.
• Use firewall rules to drop unexpected tunnel protocols.
• Monitor Arista security advisories for patch availability.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Packets with destination IP matching configured decapsulation IP but using unexpected tunnel protocols (e.g., GRE instead of VXLAN).
  • Increased decapsulation events in switch logs.
• Logs:
  • Syslog entries indicating decapsulation of non-configured tunnel types.
  • Alerts from IDS/IPS systems detecting anomalous tunnel traffic.
• System:
  • Unusual forwarding behavior or traffic reaching internal networks that should be isolated.

Detection Engineering

YARA Rule

rule CVE_2026_7473_Arista_EOS_Tunnel_Decap {
    meta:
        description = "Detects packets targeting Arista EOS decapsulation IP with mismatched tunnel protocol"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-7473"
    strings:
        $gre_header = { 00 00 08 00 }  // GRE header with protocol 0x0800 (IPv4)
        $vxlan_header = { 08 00 00 00 } // VXLAN header with flags
    condition:
        // Check for IP packet with destination IP matching decapsulation IP (example: 10.0.0.1)
        ip.dst == 10.0.0.1 and (
            (ip.proto == 47 and $gre_header at (ip.hl * 4)) or
            (ip.proto == 17 and $vxlan_header at (ip.hl * 4 + 8))
        )
}

Sigma Rule

title: CVE-2026-7473 - Arista EOS Tunnel Decapsulation Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic exploiting CVE-2026-7473 by sending mismatched tunnel protocol packets to Arista EOS decapsulation IPs.
author: Valters IT
date: 2026-01-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_ip: "10.0.0.1"  # Replace with actual decapsulation IP
        ip_proto:
            - 47  # GRE
            - 17  # UDP (VXLAN)
    condition: selection
falsepositives:
    - Legitimate multi-protocol tunnel configurations
level: high

Suricata Rule

alert ip any any -> 10.0.0.1 any (msg:"CVE-2026-7473 - Arista EOS Tunnel Decapsulation Bypass"; ip_proto:47; content:"|00 00 08 00|"; depth:4; offset:20; sid:1000001; rev:1;)
alert ip any any -> 10.0.0.1 any (msg:"CVE-2026-7473 - Arista EOS Tunnel Decapsulation Bypass (VXLAN)"; ip_proto:17; content:"|08 00 00 00|"; depth:4; offset:28; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable tunnel decapsulation on all Arista EOS switches if not required for business operations.
2. Implement access control lists (ACLs) to restrict which source IPs can send tunneled packets to decapsulation IPs.
3. Monitor network traffic for anomalous tunnel protocol usage and decapsulation events.

Long-term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Upgrade to a patched version of Arista EOS once released.
• Conduct a security review of tunnel configurations and ensure protocol type validation is enforced.

Workaround:

• Use firewall rules to drop all tunnel protocols except the expected one (e.g., only allow VXLAN if configured).
• Enable logging on decapsulation interfaces to detect abuse.

Valters IT
DevSecOps & Cyber Threat Intelligence