CVE-2026-7473

Published: Jun 5, 2026Modified: Jun 9, 2026CISA KEV

6.9

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: psirt@arista.com (Secondary)

Description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Affected (1)

Products: Arista: Eos

Arista

1 product

Eos

Configuration A

1 vulnerable · 101 platform

Vulnerable Software	Affected Versions
Arista Eos	All versions

Running on/with	Platform Versions
Arista 7020sr 24c2	All versions
Arista 7020sr 32c2	All versions
Arista 7020srg 24c2	All versions
Arista 7020tr 48	All versions
Arista 7020tra 48	All versions
Arista 7280cr 48	All versions
Arista 7280cr2 60	All versions
Arista 7280cr2a 30	All versions
Arista 7280cr2a 60	All versions
Arista 7280cr2k 30	All versions
Arista 7280cr2k 60	All versions
Arista 7280cr2m 30	All versions
Arista 7280cr3 32d4	All versions
Arista 7280cr3 32p4	All versions
Arista 7280cr3 36s	All versions
Arista 7280cr3 96	All versions
Arista 7280cr3a 24d12	All versions
Arista 7280cr3a 48d6	All versions
Arista 7280cr3a 72	All versions
Arista 7280cr3ak 24d12	All versions
Arista 7280cr3ak 48d6	All versions
Arista 7280cr3ak 72	All versions
Arista 7280cr3am 24d12	All versions
Arista 7280cr3am 48d6	All versions
Arista 7280cr3am 72	All versions
Arista 7280cr3mk 32d4s	All versions
Arista 7280cr3mk 32p4s	All versions
Arista 7280dr3 24	All versions
Arista 7280dr3a 36	All versions
Arista 7280dr3a 54	All versions
Arista 7280dr3ak 36	All versions
Arista 7280dr3ak 54	All versions
Arista 7280dr3am 36	All versions
Arista 7280dr3am 54	All versions
Arista 7280pr3 24	All versions
Arista 7280qr C36	All versions
Arista 7280qr C36 M	All versions
Arista 7280qr C72	All versions
Arista 7280qra C36s	All versions
Arista 7280qra C36sm	All versions
Arista 7280sr 48c6	All versions
Arista 7280sr2 48yc6	All versions
Arista 7280sr2 48yc6 M	All versions
Arista 7280sr2a 48yc6	All versions
Arista 7280sr2a 48yc6 M	All versions
Arista 7280sr2k 48c6 M	All versions
Arista 7280sr3 40yc6	All versions
Arista 7280sr3 48yc8	All versions
Arista 7280sr3m 48yc8	All versions
Arista 7280sra 48c6	All versions
Arista 7280sra 48c6 M	All versions
Arista 7280sram 48c6	All versions
Arista 7280srm 40cx2	All versions
Arista 7280tr 48c6	All versions
Arista 7280tr3 40c6	All versions
Arista 7280tra 48c6	All versions
Arista 7280tra 48c6 M	All versions
Arista 7289r3a Sc	All versions
Arista 7289r3ak Sc	All versions
Arista 7289r3am Sc	All versions
Arista 7500r 36cq Lc	All versions
Arista 7500r 36q Lc	All versions
Arista 7500r 48s2cq Lc	All versions
Arista 7500r 8cfpx Lc	All versions
Arista 7500r2 36cq Lc	All versions
Arista 7500r2a 36cq Lc	All versions
Arista 7500r2ak 36cq Lc	All versions
Arista 7500r2ak 48ycq Lc	All versions
Arista 7500r2am 36cq Lc	All versions
Arista 7500r2m 36cq Lc	All versions
Arista 7500r3 24d	All versions
Arista 7500r3 24p	All versions
Arista 7500r3 36cq	All versions
Arista 7500r3k 36cq	All versions
Arista 7500r3k 48y4d	All versions
Arista 7500rm 36cq Lc	All versions
Arista 7504r Fm	All versions
Arista 7504r3	All versions
Arista 7508r Fm	All versions
Arista 7508r3	All versions
Arista 7512r Fm	All versions
Arista 7512r3	All versions
Arista 7516 Sup2	All versions
Arista 7516n Ch	All versions
Arista 7516r Fm	All versions
Arista 7800r3 36d	All versions
Arista 7800r3 48cq	All versions
Arista 7800r3a 36d	All versions
Arista 7800r3a 36dm	All versions
Arista 7800r3a 36p	All versions
Arista 7800r3a 36pm	All versions
Arista 7800r3ak 36dm	All versions
Arista 7800r3ak 36pm	All versions
Arista 7800r3k 48cq	All versions
Arista 7800r3k 48cqms	All versions
Arista 7800r3k 72y	All versions
Arista 7804r3	All versions
Arista 7808r3	All versions
Arista 7812r3	All versions
Arista 7816lr3	All versions
Arista 7816r3	All versions

Related CWEs

CWE-1023

Incomplete Comparison with Missing Factors

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

References (3)

https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137

Source: psirt@arista.com

Broken Link

https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vendor AdvisoryMitigation

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.