Common Weakness Enumeration
CWE-345
DiscouragedInsufficient Verification of Data Authenticity
Abstraction: Class · Status: Draft
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
1181 vulnerabilities reference this CWE, most recent first.
CVE-2026-74875 (GCVE-0-2026-74875)
Vulnerability from cvelistv5 – Published: 2026-08-17 11:04 – Updated: 2026-08-17 15:15
VLAI
EPSS
VEX
Title
openssl_encrypt before 1.4.0 Schema Validation Bypass
Summary
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:14 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/jahlives/openssl_encrypt/secur… | vendor-advisory |
| https://www.vulncheck.com/advisories/openssl-encr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jahlives | openssl_encrypt |
Affected:
0 , < 1.4.0
(semver)
Unaffected: 1.4.0 (semver) |
Date Public
2026-02-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:14:54.956263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:15:05.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/openssl_encrypt",
"product": "openssl_encrypt",
"vendor": "jahlives",
"versions": [
{
"lessThan": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.4.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T11:04:43.579Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-425g-fjhq-5h92)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-425g-fjhq-5h92"
},
{
"name": "VulnCheck Advisory: openssl_encrypt before 1.4.0 Schema Validation Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-schema-validation-bypass"
}
],
"title": "openssl_encrypt before 1.4.0 Schema Validation Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74875",
"datePublished": "2026-08-17T11:04:43.579Z",
"dateReserved": "2026-08-17T10:31:04.593Z",
"dateUpdated": "2026-08-17T15:15:05.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73846 (GCVE-0-2026-73846)
Vulnerability from cvelistv5 – Published: 2026-08-14 16:56 – Updated: 2026-08-17 19:32
VLAI
EPSS
VEX
Title
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Summary
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 19:32 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ondata/ckan-mcp-server/securit… | x_refsource_CONFIRM |
| https://github.com/ondata/ckan-mcp-server/commit/… | x_refsource_MISC |
| https://github.com/ondata/ckan-mcp-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ondata | ckan-mcp-server |
Affected:
< 0.4.112
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73846",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T19:32:34.434443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T19:32:41.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ckan-mcp-server",
"vendor": "ondata",
"versions": [
{
"status": "affected",
"version": "\u003c 0.4.112"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim\u0027s distinct query. This issue is fixed in version 0.4.112."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:56:23.752Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6"
},
{
"name": "https://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151"
},
{
"name": "https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112"
}
],
"source": {
"advisory": "GHSA-78x9-fhhx-v2g6",
"discovery": "UNKNOWN"
},
"title": "CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73846",
"datePublished": "2026-08-14T16:56:23.752Z",
"dateReserved": "2026-08-13T17:44:28.643Z",
"dateUpdated": "2026-08-17T19:32:41.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73840 (GCVE-0-2026-73840)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:52 – Updated: 2026-08-14 16:26
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:25 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4239 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4252 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4253 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/2… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/8… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/f… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.3
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:25:46.438980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:26:09.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.3"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:52:27.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4239",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4239"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4252",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4252"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4253",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4253"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-c5f6-2rm9-2w8g",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73840",
"datePublished": "2026-08-13T21:52:27.798Z",
"dateReserved": "2026-08-13T17:44:28.640Z",
"dateUpdated": "2026-08-14T16:26:09.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73657 (GCVE-0-2026-73657)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:15 – Updated: 2026-08-17 17:18
VLAI
EPSS
VEX
Title
Trigger.dev: Cross-tenant payload poisoning via packet write + replay
Summary
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant's run by friendlyId, consuming victim resources and repeating side effects; when `payloadType: "application/store"` is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 17:14 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/triggerdotdev/trigger.dev/secu… | x_refsource_CONFIRM |
| https://github.com/triggerdotdev/trigger.dev/pull/3756 | x_refsource_MISC |
| https://github.com/triggerdotdev/trigger.dev/comm… | x_refsource_MISC |
| https://github.com/triggerdotdev/trigger.dev/rele… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| triggerdotdev | trigger.dev |
Affected:
>= 4.4.2, < 4.5.0-rc.4
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T17:14:03.402915Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:18:31.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "trigger.dev",
"vendor": "triggerdotdev",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.4.2, \u003c 4.5.0-rc.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant\u0027s run by friendlyId, consuming victim resources and repeating side effects; when `payloadType: \"application/store\"` is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:15:13.982Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jx48-qfwm-xq67",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jx48-qfwm-xq67"
},
{
"name": "https://github.com/triggerdotdev/trigger.dev/pull/3756",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/triggerdotdev/trigger.dev/pull/3756"
},
{
"name": "https://github.com/triggerdotdev/trigger.dev/commit/e1950778e2f2007e2d432b8f8a8fc89531c51f19",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/triggerdotdev/trigger.dev/commit/e1950778e2f2007e2d432b8f8a8fc89531c51f19"
},
{
"name": "https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.0-rc.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.0-rc.4"
}
],
"source": {
"advisory": "GHSA-jx48-qfwm-xq67",
"discovery": "UNKNOWN"
},
"title": "Trigger.dev: Cross-tenant payload poisoning via packet write + replay"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73657",
"datePublished": "2026-08-13T21:15:13.982Z",
"dateReserved": "2026-08-13T14:04:09.605Z",
"dateUpdated": "2026-08-17T17:18:31.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73450 (GCVE-0-2026-73450)
Vulnerability from cvelistv5 – Published: 2026-09-16 02:32 – Updated: 2026-09-17 17:41
VLAI
EPSS
VEX
Title
Security Advisory 0161
Summary
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:41 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) Affected: 0.0.0 , < 4.33.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:41:23.594863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:41:33.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
},
{
"lessThan": "4.33.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73450, all of the following conditions must be met:\u003cbr\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cspan\u003eMLAG must be configured\u003c/span\u003e\u003c/li\u003e\u003cli\u003edomain-id and peer-link are active\u003c/li\u003e\u003cli\u003eUDP heartbeat peer address must be configured\u003c/li\u003e\u003cli\u003edual-primary detection must be configured with action errdisable all-interfaces\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eBoth peers must have this configuration applied to be vulnerable.\u003c/p\u003e\u003cp\u003eExample vulnerable configuration:\u003c/p\u003e\u003cpre\u003eswitch(config)# mlag\nswitch(config-mlag)# peer-link port-channel 10\nswitch(config-mlag)# domain-id mlagDomain\nswitch(config-mlag)# peer-address heartbeat 172.30.118.190\nswitch(config-mlag)# dual-primary detection delay 5 action errdisable all-interfaces\u003c/pre\u003e\u003cp\u003eExample show command output for vulnerable configuration:\u003c/p\u003e\u003cpre\u003eswitch# show mlag\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\nMLAG Configuration:\ndomain-id \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; mlagDomain\nlocal-interface \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Vlan4094\npeer-address\u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 10.0.0.2\npeer-link \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; Port-Channel10\nhb-peer-address \u0026nbsp; : \u0026nbsp; \u0026nbsp; 172.30.118.190\n \nMLAG Status:\nstate \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Active\n\u2026\u0026nbsp;\nMLAG ports:\n\u2026\n \nMLAG Detailed Status:\n\u2026\nDual-primary detection delay \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 5\nDual-primary action\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; :\u0026nbsp; \u0026nbsp; \u0026nbsp; errdisable-all\nDual-primary recovery delay\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0\nDual-primary non-mlag recovery delay : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73450, all of the following conditions must be met:\n\n\n * MLAG must be configured\n * domain-id and peer-link are active\n * UDP heartbeat peer address must be configured\n * dual-primary detection must be configured with action errdisable all-interfaces\n\n\n\n\n\n\nBoth peers must have this configuration applied to be vulnerable.\n\n\n\nExample vulnerable configuration:\n\n\n\nswitch(config)# mlag\nswitch(config-mlag)# peer-link port-channel 10\nswitch(config-mlag)# domain-id mlagDomain\nswitch(config-mlag)# peer-address heartbeat 172.30.118.190\nswitch(config-mlag)# dual-primary detection delay 5 action errdisable all-interfaces\n\n\n\nExample show command output for vulnerable configuration:\n\n\n\nswitch# show mlag\u00a0\u00a0\u00a0\u00a0\nMLAG Configuration:\ndomain-id \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 mlagDomain\nlocal-interface \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Vlan4094\npeer-address\u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 10.0.0.2\npeer-link \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 Port-Channel10\nhb-peer-address \u00a0 : \u00a0 \u00a0 172.30.118.190\n \nMLAG Status:\nstate \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Active\n\u2026\u00a0\nMLAG ports:\n\u2026\n \nMLAG Detailed Status:\n\u2026\nDual-primary detection delay \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 5\nDual-primary action\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 :\u00a0 \u00a0 \u00a0 errdisable-all\nDual-primary recovery delay\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\nDual-primary non-mlag recovery delay : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption."
}
],
"impacts": [
{
"capecId": "CAPEC-141",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-141 Message Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:32:45.999Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0161",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24717-security-advisory-0161"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience."
}
],
"source": {
"advisory": "0161",
"defects": [
"BUG1852792"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0161",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict access to the MLAG heartbeat interface by configuring Access Control Lists (ACLs) to permit traffic strictly from the designated peer address.\u003c/p\u003e\u003cp\u003eInsert the following ACL rules into the top of the ingress ACL on the VRF where the heartbeat address is configured, while denying traffic from all other source addresses.\u003c/p\u003e\u003cpre\u003epermit udp host \u0026lt;heartbeatPeerAddress\u0026gt; any eq mlag\npermit udp any any eq mlag ttl eq 255\ndeny udp any any eq mlag log\u003c/pre\u003e\u003cp\u003eEnsure administrative access for required services (e.g., SSH, NTP, SNMP) remains permitted.\u003c/p\u003e\u003cp\u003eFor instance, if the heartbeat address is reachable via the management VRF. First, construct the ingress ACL to restrict access on the MLAG heartbeat interface.\u003c/p\u003e\u003cpre\u003eswitch(config)#ip access-list MLAG-HEARTBEAT-PROTECT\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#5 permit udp host 172.30.118.190 any eq mlag\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#6 permit udp any any eq mlag ttl eq 255\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#7 deny udp any any eq mlag log\n...\u003c/pre\u003e\u003cp\u003eApply the ACL to management VRF:\u003c/p\u003e\u003cpre\u003eswitch(config)#system control-plane\nswitch(config-system-cp)#ip access-group MLAG-HEARTBEAT-PROTECT vrf management in\nswitch(config-system-cp)#exit\u003c/pre\u003e\u003cp\u003eShow command to confirm the rules:\u003c/p\u003e\u003cpre\u003eswitch(config)#show ip access-lists MLAG-HEARTBEAT-PROTECT\nPhone ACL bypass: disabled\nIP Access List MLAG-HEARTBEAT-PROTECT\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;5 permit udp host 172.30.118.190 any eq mlag\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;6 permit udp any any eq mlag ttl eq 255\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;7 deny udp any any eq mlag log\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\n \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Total rules configured: \u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Configured on Ingress: control-plane(management VRF)\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Active on \u0026nbsp; \u0026nbsp; Ingress: control-plane(management VRF)\u003c/pre\u003e"
}
],
"value": "Restrict access to the MLAG heartbeat interface by configuring Access Control Lists (ACLs) to permit traffic strictly from the designated peer address.\n\n\n\nInsert the following ACL rules into the top of the ingress ACL on the VRF where the heartbeat address is configured, while denying traffic from all other source addresses.\n\n\n\npermit udp host \u003cheartbeatPeerAddress\u003e any eq mlag\npermit udp any any eq mlag ttl eq 255\ndeny udp any any eq mlag log\n\n\n\nEnsure administrative access for required services (e.g., SSH, NTP, SNMP) remains permitted.\n\n\n\nFor instance, if the heartbeat address is reachable via the management VRF. First, construct the ingress ACL to restrict access on the MLAG heartbeat interface.\n\n\n\nswitch(config)#ip access-list MLAG-HEARTBEAT-PROTECT\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#5 permit udp host 172.30.118.190 any eq mlag\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#6 permit udp any any eq mlag ttl eq 255\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#7 deny udp any any eq mlag log\n...\n\n\n\nApply the ACL to management VRF:\n\n\n\nswitch(config)#system control-plane\nswitch(config-system-cp)#ip access-group MLAG-HEARTBEAT-PROTECT vrf management in\nswitch(config-system-cp)#exit\n\n\n\nShow command to confirm the rules:\n\n\n\nswitch(config)#show ip access-lists MLAG-HEARTBEAT-PROTECT\nPhone ACL bypass: disabled\nIP Access List MLAG-HEARTBEAT-PROTECT\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a05 permit udp host 172.30.118.190 any eq mlag\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a06 permit udp any any eq mlag ttl eq 255\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a07 deny udp any any eq mlag log\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u2026\n \n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Total rules configured: \u2026\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Configured on Ingress: control-plane(management VRF)\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Active on \u00a0 \u00a0 Ingress: control-plane(management VRF)"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73450",
"datePublished": "2026-09-16T02:32:45.999Z",
"dateReserved": "2026-08-12T16:42:47.921Z",
"dateUpdated": "2026-09-17T17:41:33.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73437 (GCVE-0-2026-73437)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:02 – Updated: 2026-09-17 03:57
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
Summary
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 00:00 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) |
Date Public
2026-09-09 21:02
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73437",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T03:57:04.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.33.10M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable to CVE-2026-73437, the DHCP relay must be configured, and either an IPv4 or IPv6 helper address must be configured for the DHCP relay to be active.\u003c/p\u003e\u003cp\u003eE.g., Configuring an IPv4 helper address:\u003c/p\u003e\u003cpre\u003eswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ip helper-address 10.40.2.3\u003c/pre\u003e\u003cp\u003eE.g., Configuring an IPv6 helper address:\u003c/p\u003e\u003cpre\u003eswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ipv6 helper-address 3ffe:701:ffff:100::2\u003c/pre\u003e\u003cp\u003eValidation:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show ip dhcp relay\nDHCP relay is active\n...\nInterface: Vlan100\n DHCPv4 servers: 10.40.2.3\n DHCPv6 servers: 3ffe:701:ffff:100::2\u003c/pre\u003e\u003cp\u003eIf DHCP relay is not active (no helper addresses), there is no exposure to this issue:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show ip dhcp relay\nDHCP relay is not active\u003c/pre\u003e"
}
],
"value": "To be vulnerable to CVE-2026-73437, the DHCP relay must be configured, and either an IPv4 or IPv6 helper address must be configured for the DHCP relay to be active.\n\n\n\nE.g., Configuring an IPv4 helper address:\n\n\n\nswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ip helper-address 10.40.2.3\n\n\n\nE.g., Configuring an IPv6 helper address:\n\n\n\nswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ipv6 helper-address 3ffe:701:ffff:100::2\n\n\n\nValidation:\n\n\n\nswitch\u003eshow ip dhcp relay\nDHCP relay is active\n...\nInterface: Vlan100\n DHCPv4 servers: 10.40.2.3\n DHCPv6 servers: 3ffe:701:ffff:100::2\n\n\n\nIf DHCP relay is not active (no helper addresses), there is no exposure to this issue:\n\n\n\nswitch\u003eshow ip dhcp relay\nDHCP relay is not active"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"datePublic": "2026-09-09T21:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients."
}
],
"impacts": [
{
"capecId": "CAPEC-68",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-68 IP Address Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:02:49.314Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience and enable the reply source-address validation CLI knob under dhcp relay mode:\u003c/p\u003e\u003cpre\u003eswitch(config)# dhcp relay\nswitch(config-dhcp-relay)# reply source-address validation\u003c/pre\u003e\u003cp\u003eCVE-2026-73437 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e All versions require upgrading to a release containing the fix (as listed above) and applying the required configuration. Arista will not be providing any hotfixes.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience and enable the reply source-address validation CLI knob under dhcp relay mode:\n\n\n\nswitch(config)# dhcp relay\nswitch(config-dhcp-relay)# reply source-address validation\n\n\n\nCVE-2026-73437 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train\n * 4.33.10M and later releases in the 4.33.x train\n\n\n\n\nNote: All versions require upgrading to a release containing the fix (as listed above) and applying the required configuration. Arista will not be providing any hotfixes."
}
],
"source": {
"advisory": "156",
"defect": [
"1869660"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIP locking can be run in a locked address enforcement disabled state, along with the DHCP Relay, to provide protection against rogue DHCP servers and spoofing. This is supported on DHCPv4 starting with EOS-4.29.0F and on DHCPv6 starting with EOS-4.27.0F. For more information, see \u003ca href=\"https://www.arista.com/en/support/toi/eos-4-25-1f/14628-ip-locking-release-updates\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eIP Locking\u003c/a\u003e.\u003c/p\u003e\u003cdiv\u003eThis is compatible with the following platforms only:\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cul\u003e\u003cli\u003eCCS-720XP\u003c/li\u003e\u003cli\u003eCCS-710P\u003c/li\u003e\u003cli\u003eCCS-720DP\u003c/li\u003e\u003cli\u003eCCS-722XPM\u003c/li\u003e\u003cli\u003eDCS-7010TX\u003c/li\u003e\u003cli\u003eDCS-7050CX3\u003c/li\u003e\u003cli\u003eDCS-7050SX3\u003c/li\u003e\u003cli\u003eCCS-710XP\u003c/li\u003e\u003cli\u003eCCS-720DF\u003c/li\u003e\u003cli\u003eCCS-720DT\u003c/li\u003e\u003cli\u003eCCS-720XDM\u003c/li\u003e\u003cli\u003eCCS-720XPM\u003c/li\u003e\u003cli\u003eCCS-755\u003c/li\u003e\u003cli\u003eCCS-758\u003c/li\u003e\u003cli\u003eDCS-7050CX3M\u003c/li\u003e\u003cli\u003eDCS-7050TX3\u003c/li\u003e\u003cli\u003eDCS-7304\u003c/li\u003e\u003cli\u003eDCS-7308\u003c/li\u003e\u003cli\u003e7300X3\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eUntrusted ports can be locked with the following configuration:\u003c/p\u003e\u003cpre\u003eswitch(config)# address locking\nswitch(config-address-locking)# locked-address ipv4 enforcement disabled\nswitch(config-address-locking)# locked-address ipv6 enforcement disabled\n \nswitch(config)# int et 5\nswitch(config-if-Et5)# address locking ?\n\u0026nbsp;\u0026nbsp;ipv4\u0026nbsp; Enable address locking for IPv4\n\u0026nbsp;\u0026nbsp;ipv6\u0026nbsp; Enable address locking for IPv6\n\u0026nbsp;\u0026nbsp;\u0026lt;cr\u0026gt;\nswitch(config-if-Et5)# address locking ipv4\nswitch(config-if-Et5)# address locking ipv6\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThe above configuration can be validated using the following output:\u003c/p\u003e\u003cpre\u003eswitch# show address locking\nIP Locking is active\nLogging events: None\nBindings persistence is enabled\nBindings last backup time: Not Available\nConfigured IPv4 Interfaces: \u0026nbsp; \u0026nbsp; \u0026nbsp; Et5\nConfigured IPv6 Interfaces: \u0026nbsp; \u0026nbsp; \u0026nbsp; Et5\nConfigured IPv4 VLANs:\nConfigured IPv6 VLANs:\n \nInterface Status\nInterface\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; IPv4 \u0026nbsp; \u0026nbsp; \u0026nbsp; IPv6\n---------------- ---------- -------------------\nEthernet5\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; yes* \u0026nbsp; \u0026nbsp; \u0026nbsp; yes*\n \n* Locked address enforcement is disabled\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eWith the above configuration applied, DHCP traffic from untrusted ports can be blocked and the following output reflects the packet drops:\u003c/p\u003e\u003cpre\u003eswitch#show address locking counters detail\nAction\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Count\n--------------------------------- -----\nARP (0.0.0.0) PERMIT\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0\nDHCP from client to server PERMIT \u0026nbsp; \u0026nbsp; 0\nDHCP from server DROP \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 4\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn releases prior to EOS-4.35.0F, \u201c\u003cb\u003eshow address locking counters detail\u003c/b\u003e\u201d command is not available. Instead, run \u201c\u003cb\u003eshow platform trident tcam detail\u003c/b\u003e\u201d and grep for these IP Locking counters.\u003c/p\u003e\u003cpre\u003eswitch#show platform trident tcam detail\n=== TCAM detail for switch Linecard0/0 ===\nGroups programmed in IFP\n...\nTCAM group 129 copy 0 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u0026nbsp;\u0026nbsp;IP Locking v4 uses 3 entries.\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0000005c\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - Unknown ARP permit rule\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0000005d\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP permit from client\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x00000060\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 4 hits - DHCP drop from server\nTCAM group 129 copy 1 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u0026nbsp;\u0026nbsp;IP Locking v4 uses 3 entries.\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0800005c\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - Unknown ARP permit rule\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0800005d\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP permit from client\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x08000060\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP drop from server\u003c/pre\u003e"
}
],
"value": "IP locking can be run in a locked address enforcement disabled state, along with the DHCP Relay, to provide protection against rogue DHCP servers and spoofing. This is supported on DHCPv4 starting with EOS-4.29.0F and on DHCPv6 starting with EOS-4.27.0F. For more information, see IP Locking https://www.arista.com/en/support/toi/eos-4-25-1f/14628-ip-locking-release-updates .\n\nThis is compatible with the following platforms only:\n\n\u00a0\n\n * CCS-720XP\n * CCS-710P\n * CCS-720DP\n * CCS-722XPM\n * DCS-7010TX\n * DCS-7050CX3\n * DCS-7050SX3\n * CCS-710XP\n * CCS-720DF\n * CCS-720DT\n * CCS-720XDM\n * CCS-720XPM\n * CCS-755\n * CCS-758\n * DCS-7050CX3M\n * DCS-7050TX3\n * DCS-7304\n * DCS-7308\n * 7300X3\n\n\n\n\nUntrusted ports can be locked with the following configuration:\n\n\n\nswitch(config)# address locking\nswitch(config-address-locking)# locked-address ipv4 enforcement disabled\nswitch(config-address-locking)# locked-address ipv6 enforcement disabled\n \nswitch(config)# int et 5\nswitch(config-if-Et5)# address locking ?\n\u00a0\u00a0ipv4\u00a0 Enable address locking for IPv4\n\u00a0\u00a0ipv6\u00a0 Enable address locking for IPv6\n\u00a0\u00a0\u003ccr\u003e\nswitch(config-if-Et5)# address locking ipv4\nswitch(config-if-Et5)# address locking ipv6\n\n\n\u00a0\n\n\n\nThe above configuration can be validated using the following output:\n\n\n\nswitch# show address locking\nIP Locking is active\nLogging events: None\nBindings persistence is enabled\nBindings last backup time: Not Available\nConfigured IPv4 Interfaces: \u00a0 \u00a0 \u00a0 Et5\nConfigured IPv6 Interfaces: \u00a0 \u00a0 \u00a0 Et5\nConfigured IPv4 VLANs:\nConfigured IPv6 VLANs:\n \nInterface Status\nInterface\u00a0 \u00a0 \u00a0 \u00a0 IPv4 \u00a0 \u00a0 \u00a0 IPv6\n---------------- ---------- -------------------\nEthernet5\u00a0 \u00a0 \u00a0 \u00a0 yes* \u00a0 \u00a0 \u00a0 yes*\n \n* Locked address enforcement is disabled\n\n\n\u00a0\n\n\n\nWith the above configuration applied, DHCP traffic from untrusted ports can be blocked and the following output reflects the packet drops:\n\n\n\nswitch#show address locking counters detail\nAction\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Count\n--------------------------------- -----\nARP (0.0.0.0) PERMIT\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\nDHCP from client to server PERMIT \u00a0 \u00a0 0\nDHCP from server DROP \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4\n\n\n\u00a0\n\n\n\nIn releases prior to EOS-4.35.0F, \u201cshow address locking counters detail\u201d command is not available. Instead, run \u201cshow platform trident tcam detail\u201d and grep for these IP Locking counters.\n\n\n\nswitch#show platform trident tcam detail\n=== TCAM detail for switch Linecard0/0 ===\nGroups programmed in IFP\n...\nTCAM group 129 copy 0 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u00a0\u00a0IP Locking v4 uses 3 entries.\n\u00a0\u00a0\u00a0\u00a00x0000005c\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - Unknown ARP permit rule\n\u00a0\u00a0\u00a0\u00a00x0000005d\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP permit from client\n\u00a0\u00a0\u00a0\u00a00x00000060\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4 hits - DHCP drop from server\nTCAM group 129 copy 1 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u00a0\u00a0IP Locking v4 uses 3 entries.\n\u00a0\u00a0\u00a0\u00a00x0800005c\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - Unknown ARP permit rule\n\u00a0\u00a0\u00a0\u00a00x0800005d\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP permit from client\n\u00a0\u00a0\u00a0\u00a00x08000060\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP drop from server"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73437",
"datePublished": "2026-09-15T21:02:49.314Z",
"dateReserved": "2026-08-12T16:39:35.976Z",
"dateUpdated": "2026-09-17T03:57:04.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73435 (GCVE-0-2026-73435)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:19 – Updated: 2026-09-16 15:29
VLAI
EPSS
VEX
Title
Security Advisory 0171
Summary
On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:28 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 1.0.0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T15:28:37.069647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:29:43.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010 Series",
"7010X Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7150 Series",
"7160 Series",
"7170 Series",
"7050X/X2/X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7250X Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73435, all of the following conditions must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003eThe vulnerable OSPFv2 instance must have at least two neighbors on the same interface.\u003c/li\u003e\u003cli\u003eThe interface is a broadcast interface.\u003c/li\u003e\u003cli\u003eOSPFv2 cryptographic authentication is configured.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eHere is an example showing a vulnerable OSPFv2 instance with a minimum of two neighbors on the same interface:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip ospf neighbor\nNeighbor ID Instance VRF ... Interface\nX.X.X.X X ... ... \u0026lt;intf\u0026gt;\nX.X.X.X X ... ... \u0026lt;intf\u0026gt;\u003c/pre\u003e\u003cp\u003eHere is an example showing the vulnerable configuration of Network Type \u0026quot;Broadcast\u0026quot; and Message-digest authentication (cryptographic authentication) configured:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip ospf interface\n\u0026lt;intf\u0026gt; is up\n Interface Address X.X.X.X/X, instance X, VRF X, Area X.X.X.X\n Network Type Broadcast, Cost: X\n ...\n Message-digest authentication, using key id X\n ...\u003c/pre\u003e\u003cp\u003eNote: Both \u0026quot;Message-digest authentication\u0026quot; (MD5) and \u0026quot;Message-digest sha\u0026lt;X\u0026gt; authentication\u0026quot; (SHA) are vulnerable.\u003c/p\u003e\u003cp\u003eTo check area-level authentication, reference the vulnerable interface area ID in \u0026quot;show ip ospf\u0026quot; output:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip ospf\nOSPF instance X with ID X.X.X.X VRF X\n...\nArea X.X.X.X\n Number of interface in this area is X\n It is a X area\n Traffic engineering is disabled\n Area has MD5 authentication\u003c/pre\u003e\u003cp\u003eIf the area has \u0026quot;Simple\u0026quot; or \u0026quot;None\u0026quot; authentication, then at the area-level, the third prerequisite is unmet and the system would not be vulnerable to this particular issue.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73435, all of the following conditions must be met:\n\n1. The vulnerable OSPFv2 instance must have at least two neighbors on the same interface.\n2. The interface is a broadcast interface.\n3. OSPFv2 cryptographic authentication is configured."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.\u003c/p\u003e\u003cp\u003eThese issues were discovered internally by Arista, and the company is not aware of any malicious uses of these issues in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:38.708Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0171",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24727-security-advisory-0171"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73435 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eA hotfix is available for the following releases: 4.36.1F, 4.35.5M, 4.34.7M, 4.33.9M.\u003cbr\u003eURL: https://www.arista.com/support/advisories-notices/sa-download/?sa171-SecurityAdvisory171_CVE-2026-73435.swix\u003cbr\u003eSWIX hash (SHA512): 4c4ff053d8165f347b45dfcafc2d20396e3eb00869b0088f3128be7f53b2a028b479fa8279849c800b5916ab9aaf8077718a68e3bf4277d55b44076650de0aa7\u003cbr\u003eNote: Installing/uninstalling the SWIX will cause the Ospf process to restart.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73435 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.7.1M and later releases in the 4.34.x train\n- 4.33.10M and later releases in the 4.33.x train\n\nA hotfix is available for the following releases: 4.36.1F, 4.35.5M, 4.34.7M, 4.33.9M.\nURL: https://www.arista.com/support/advisories-notices/sa-download/?sa171-SecurityAdvisory171_CVE-2026-73435.swix\nSWIX hash (SHA512): 4c4ff053d8165f347b45dfcafc2d20396e3eb00869b0088f3128be7f53b2a028b479fa8279849c800b5916ab9aaf8077718a68e3bf4277d55b44076650de0aa7\nNote: Installing/uninstalling the SWIX will cause the Ospf process to restart."
}
],
"source": {
"advisory": "Security Advisory 0171",
"defects": [
"BUG 1843809"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0171",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation is available for CVE-2026-73435.\u003c/p\u003e"
}
],
"value": "No mitigation is available for CVE-2026-73435."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73435",
"datePublished": "2026-09-16T09:19:47.285Z",
"dateReserved": "2026-08-12T16:39:35.976Z",
"dateUpdated": "2026-09-16T15:29:43.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73419 (GCVE-0-2026-73419)
Vulnerability from cvelistv5 – Published: 2026-08-12 20:23 – Updated: 2026-08-13 15:32
VLAI
EPSS
VEX
Title
NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Summary
NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:32 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/nextauthjs/next-auth/security/… | x_refsource_CONFIRM |
| https://github.com/nextauthjs/next-auth/pull/13469 | x_refsource_MISC |
| https://github.com/nextauthjs/next-auth/commit/5b… | x_refsource_MISC |
| https://github.com/nextauthjs/next-auth/commit/9f… | x_refsource_MISC |
| https://github.com/nextauthjs/next-auth/releases/… | x_refsource_MISC |
| https://github.com/nextauthjs/next-auth/releases/… | x_refsource_MISC |
| https://github.com/nextauthjs/next-auth/releases/… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| nextauthjs | next-auth |
Affected:
< 4.24.15
Affected: >= 5.0.0-beta.4, < 5.0.0-beta.32 |
|
| @auth | core |
Affected:
< 0.41.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73419",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:32:05.776262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:32:15.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "next-auth",
"vendor": "nextauthjs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.24.15"
},
{
"status": "affected",
"version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
}
]
},
{
"product": "core",
"vendor": "@auth",
"versions": [
{
"status": "affected",
"version": "\u003c 0.41.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider\u0027s identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider\u0027s authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker\u0027s target-provider account to the victim\u0027s Auth.js user. The linked provider grants the attacker persistent sign-in to the victim\u0027s account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-940",
"description": "CWE-940: Improper Verification of Source of a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T20:23:39.174Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279"
},
{
"name": "https://github.com/nextauthjs/next-auth/pull/13469",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextauthjs/next-auth/pull/13469"
},
{
"name": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"
},
{
"name": "https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852"
},
{
"name": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
},
{
"name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
},
{
"name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
}
],
"source": {
"advisory": "GHSA-x445-f3h2-j279",
"discovery": "UNKNOWN"
},
"title": "NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73419",
"datePublished": "2026-08-12T20:23:39.174Z",
"dateReserved": "2026-08-12T14:32:11.795Z",
"dateUpdated": "2026-08-13T15:32:15.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73316 (GCVE-0-2026-73316)
Vulnerability from cvelistv5 – Published: 2026-09-08 13:18 – Updated: 2026-09-10 15:03
VLAI
EPSS
VEX
Title
XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
Summary
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:50 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://xenforo.com/community/threads/security-fi… | vendor-advisorypatch |
| https://xenforo.com/community/threads/xenforo-2-3… | release-notes |
| https://bombobombone.github.io/posts/cve-2026-73316/ | technical-description |
| https://github.com/BomboBombone/CVE-2026-73316 | exploit |
| https://www.vulncheck.com/advisories/xenforo-paym… | third-party-advisory |
Date Public
2026-09-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73316",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:50:23.706210Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T15:03:08.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XenForo",
"vendor": "XenForo",
"versions": [
{
"lessThan": "2.3.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Paciaroni (BomboBombone)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T01:09:49.997Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Vendor Advisory",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/"
},
{
"name": "Release Notes",
"tags": [
"release-notes"
],
"url": "https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/"
},
{
"name": "Researcher Advisory",
"tags": [
"technical-description"
],
"url": "https://bombobombone.github.io/posts/cve-2026-73316/"
},
{
"name": "Researcher PoC",
"tags": [
"exploit"
],
"url": "https://github.com/BomboBombone/CVE-2026-73316"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/xenforo-payment-replay-via-paypal-rest-payment-provider"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "XenForo \u003c 2.3.13 Payment Replay via PayPal REST Payment Provider",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-73316",
"datePublished": "2026-09-08T13:18:35.469Z",
"dateReserved": "2026-08-11T19:56:20.007Z",
"dateUpdated": "2026-09-10T15:03:08.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73177 (GCVE-0-2026-73177)
Vulnerability from cvelistv5 – Published: 2026-09-16 13:03 – Updated: 2026-09-17 18:59
VLAI
EPSS
VEX
Summary
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:58 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.nozominetworks.com/labs/vulnerability… | third-party-advisory |
| https://advcloudfiles.advantech.com/cms/5dafee28-… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Advantech | EKI-1242IEIMS |
Affected:
0 , ≤ 1.06.01
(semver)
|
|
| Advantech | EKI-1242EIMS |
Affected:
0 , ≤ 1.06.01
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73177",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:58:48.842501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:59:04.930Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EKI-1242IEIMS",
"vendor": "Advantech",
"versions": [
{
"lessThanOrEqual": "1.06.01",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EKI-1242EIMS",
"vendor": "Advantech",
"versions": [
{
"lessThanOrEqual": "1.06.01",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Simone Bossi at Nozomi Networks"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.\u003c/p\u003e"
}
],
"value": "Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform."
}
],
"impacts": [
{
"capecId": "CAPEC-185",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-185 Malicious Software Update"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:03:44.204Z",
"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"shortName": "Nozomi"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73177"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c",
"assignerShortName": "Nozomi",
"cveId": "CVE-2026-73177",
"datePublished": "2026-09-16T13:03:44.204Z",
"dateReserved": "2026-08-11T09:36:40.350Z",
"dateUpdated": "2026-09-17T18:59:04.930Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-141: Cache Poisoning
An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.
CAPEC-142: DNS Cache Poisoning
A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack.
CAPEC-148: Content Spoofing
An adversary modifies content to make it contain something other than what the original content producer intended while keeping the apparent source of the content unchanged. The term content spoofing is most often used to describe modification of web pages hosted by a target to display the adversary's content instead of the owner's content. However, any content can be spoofed, including the content of email messages, file transfers, or the content of other network communication protocols. Content can be modified at the source (e.g. modifying the source file for a web page) or in transit (e.g. intercepting and modifying a message between the sender and recipient). Usually, the adversary will attempt to hide the fact that the content has been modified, but in some cases, such as with web site defacement, this is not necessary. Content Spoofing can lead to malware exposure, financial fraud (if the content governs financial transactions), privacy violations, and other unwanted outcomes.
CAPEC-218: Spoofing of UDDI/ebXML Messages
An attacker spoofs a UDDI, ebXML, or similar message in order to impersonate a service provider in an e-business transaction. UDDI, ebXML, and similar standards are used to identify businesses in e-business transactions. Among other things, they identify a particular participant, WSDL information for SOAP transactions, and supported communication protocols, including security protocols. By spoofing one of these messages an attacker could impersonate a legitimate business in a transaction or could manipulate the protocols used between a client and business. This could result in disclosure of sensitive information, loss of message integrity, or even financial fraud.
CAPEC-384: Application API Message Manipulation via Man-in-the-Middle
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system. Despite the use of AiTH software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Adversary-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
CAPEC-385: Transaction or Event Tampering via Application API Manipulation
An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the content of various application elements. Often, items exchanged in game can be monetized via sales for coin, virtual dollars, etc. The purpose of the attack is for the attack to scam the victim by trapping the data packets involved the exchange and altering the integrity of the transfer process.
CAPEC-386: Application API Navigation Remapping
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
CAPEC-387: Navigation Remapping To Propagate Malicious Content
An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.
CAPEC-388: Application API Button Hijacking
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.
CAPEC-701: Browser in the Middle (BiTM)
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.