Vulnerability-Lookup

CVE-2026-73437 (GCVE-0-2026-73437)

Vulnerability from cvelistv5 – Published: 2026-09-15 21:02 – Updated: 2026-09-15 21:02

Title

Summary

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

6.5 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

Arista mitre root

References

1 reference

URL	Tags
https://www.arista.com/en/support/advisories-noti…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Arista Networks	EOS	Affected: 4.36.0 , ≤ 4.36.1F (custom) Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom)	guessed

Date Public

2026-09-09 21:02

Credits

This issue was discovered internally by Arista.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange",
            "virtual or physical appliance"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.36.2F",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.35.6M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.34.8M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.34.7.1M",
              "status": "affected",
              "version": "4.34.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.33.10M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.33.9M",
              "status": "affected",
              "version": "4.33.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTo be vulnerable to CVE-2026-73437, the DHCP relay must be configured, and either an IPv4 or IPv6 helper address must be configured for the DHCP relay to be active.\u003c/p\u003e\u003cp\u003eE.g., Configuring an IPv4 helper address:\u003c/p\u003e\u003cpre\u003eswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ip helper-address 10.40.2.3\u003c/pre\u003e\u003cp\u003eE.g., Configuring an IPv6 helper address:\u003c/p\u003e\u003cpre\u003eswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ipv6 helper-address 3ffe:701:ffff:100::2\u003c/pre\u003e\u003cp\u003eValidation:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show ip dhcp relay\nDHCP relay is active\n...\nInterface: Vlan100\n  DHCPv4 servers: 10.40.2.3\n  DHCPv6 servers: 3ffe:701:ffff:100::2\u003c/pre\u003e\u003cp\u003eIf DHCP relay is not active (no helper addresses), there is no exposure to this issue:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show ip dhcp relay\nDHCP relay is not active\u003c/pre\u003e"
            }
          ],
          "value": "To be vulnerable to CVE-2026-73437, the DHCP relay must be configured, and either an IPv4 or IPv6 helper address must be configured for the DHCP relay to be active.\n\n\n\nE.g., Configuring an IPv4 helper address:\n\n\n\nswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ip helper-address 10.40.2.3\n\n\n\nE.g., Configuring an IPv6 helper address:\n\n\n\nswitch# configure terminal\nswitch(config)#int vlan 100\nswitch(config-if-Vl100)#ipv6 helper-address 3ffe:701:ffff:100::2\n\n\n\nValidation:\n\n\n\nswitch\u003eshow ip dhcp relay\nDHCP relay is active\n...\nInterface: Vlan100\n  DHCPv4 servers: 10.40.2.3\n  DHCPv6 servers: 3ffe:701:ffff:100::2\n\n\n\nIf DHCP relay is not active (no helper addresses), there is no exposure to this issue:\n\n\n\nswitch\u003eshow ip dhcp relay\nDHCP relay is not active"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered internally by Arista."
        }
      ],
      "datePublic": "2026-09-09T21:02:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-68",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-68 IP Address Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345 Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T21:02:49.314Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience and enable the reply source-address validation CLI knob under dhcp relay mode:\u003c/p\u003e\u003cpre\u003eswitch(config)# dhcp relay\nswitch(config-dhcp-relay)# reply source-address validation\u003c/pre\u003e\u003cp\u003eCVE-2026-73437 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e All versions require upgrading to a release containing the fix (as listed above) and applying the required configuration. Arista will not be providing any hotfixes.\u003c/p\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience and enable the reply source-address validation CLI knob under dhcp relay mode:\n\n\n\nswitch(config)# dhcp relay\nswitch(config-dhcp-relay)# reply source-address validation\n\n\n\nCVE-2026-73437 has been fixed in the following releases:\n\n  *  4.36.2F and later releases in the 4.36.x train\n  *  4.35.6M and later releases in the 4.35.x train\n  *  4.34.8M and later releases in the 4.34.x train\n  *  4.33.10M and later releases in the 4.33.x train\n\n\n\n\nNote: All versions require upgrading to a release containing the fix (as listed above) and applying the required configuration. Arista will not be providing any hotfixes."
        }
      ],
      "source": {
        "advisory": "156",
        "defect": [
          "1869660"
        ],
        "discovery": "INTERNAL"
      },
      "title": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIP locking can be run in a locked address enforcement disabled state, along with the DHCP Relay, to provide protection against rogue DHCP servers and spoofing. This is supported on DHCPv4 starting with EOS-4.29.0F and on DHCPv6 starting with EOS-4.27.0F. For more information, see \u003ca href=\"https://www.arista.com/en/support/toi/eos-4-25-1f/14628-ip-locking-release-updates\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eIP Locking\u003c/a\u003e.\u003c/p\u003e\u003cdiv\u003eThis is compatible with the following platforms only:\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cul\u003e\u003cli\u003eCCS-720XP\u003c/li\u003e\u003cli\u003eCCS-710P\u003c/li\u003e\u003cli\u003eCCS-720DP\u003c/li\u003e\u003cli\u003eCCS-722XPM\u003c/li\u003e\u003cli\u003eDCS-7010TX\u003c/li\u003e\u003cli\u003eDCS-7050CX3\u003c/li\u003e\u003cli\u003eDCS-7050SX3\u003c/li\u003e\u003cli\u003eCCS-710XP\u003c/li\u003e\u003cli\u003eCCS-720DF\u003c/li\u003e\u003cli\u003eCCS-720DT\u003c/li\u003e\u003cli\u003eCCS-720XDM\u003c/li\u003e\u003cli\u003eCCS-720XPM\u003c/li\u003e\u003cli\u003eCCS-755\u003c/li\u003e\u003cli\u003eCCS-758\u003c/li\u003e\u003cli\u003eDCS-7050CX3M\u003c/li\u003e\u003cli\u003eDCS-7050TX3\u003c/li\u003e\u003cli\u003eDCS-7304\u003c/li\u003e\u003cli\u003eDCS-7308\u003c/li\u003e\u003cli\u003e7300X3\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eUntrusted ports can be locked with the following configuration:\u003c/p\u003e\u003cpre\u003eswitch(config)# address locking\nswitch(config-address-locking)# locked-address ipv4 enforcement disabled\nswitch(config-address-locking)# locked-address ipv6 enforcement disabled\n  \nswitch(config)# int et 5\nswitch(config-if-Et5)# address locking ?\n\u0026nbsp;\u0026nbsp;ipv4\u0026nbsp; Enable address locking for IPv4\n\u0026nbsp;\u0026nbsp;ipv6\u0026nbsp; Enable address locking for IPv6\n\u0026nbsp;\u0026nbsp;\u0026lt;cr\u0026gt;\nswitch(config-if-Et5)# address locking ipv4\nswitch(config-if-Et5)# address locking ipv6\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThe above configuration can be validated using the following output:\u003c/p\u003e\u003cpre\u003eswitch# show address locking\nIP Locking is active\nLogging events: None\nBindings persistence is enabled\nBindings last backup time: Not Available\nConfigured IPv4 Interfaces: \u0026nbsp; \u0026nbsp; \u0026nbsp; Et5\nConfigured IPv6 Interfaces: \u0026nbsp; \u0026nbsp; \u0026nbsp; Et5\nConfigured IPv4 VLANs:\nConfigured IPv6 VLANs:\n  \nInterface Status\nInterface\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; IPv4 \u0026nbsp; \u0026nbsp; \u0026nbsp; IPv6\n---------------- ---------- -------------------\nEthernet5\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; yes* \u0026nbsp; \u0026nbsp; \u0026nbsp; yes*\n  \n* Locked address enforcement is disabled\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eWith the above configuration applied, DHCP traffic from untrusted ports can be blocked and the following output reflects the packet drops:\u003c/p\u003e\u003cpre\u003eswitch#show address locking counters detail\nAction\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Count\n--------------------------------- -----\nARP (0.0.0.0) PERMIT\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0\nDHCP from client to server PERMIT \u0026nbsp; \u0026nbsp; 0\nDHCP from server DROP \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 4\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn releases prior to EOS-4.35.0F, \u201c\u003cb\u003eshow address locking counters detail\u003c/b\u003e\u201d command is not available. Instead, run \u201c\u003cb\u003eshow platform trident tcam detail\u003c/b\u003e\u201d and grep for these IP Locking counters.\u003c/p\u003e\u003cpre\u003eswitch#show platform trident tcam detail\n=== TCAM detail for switch Linecard0/0 ===\nGroups programmed in IFP\n...\nTCAM group 129 copy 0 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u0026nbsp;\u0026nbsp;IP Locking v4 uses 3 entries.\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0000005c\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - Unknown ARP permit rule\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0000005d\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP permit from client\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x00000060\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 4 hits - DHCP drop from server\nTCAM group 129 copy 1 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u0026nbsp;\u0026nbsp;IP Locking v4 uses 3 entries.\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0800005c\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - Unknown ARP permit rule\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x0800005d\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP permit from client\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;0x08000060\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0 hits - DHCP drop from server\u003c/pre\u003e"
            }
          ],
          "value": "IP locking can be run in a locked address enforcement disabled state, along with the DHCP Relay, to provide protection against rogue DHCP servers and spoofing. This is supported on DHCPv4 starting with EOS-4.29.0F and on DHCPv6 starting with EOS-4.27.0F. For more information, see  IP Locking https://www.arista.com/en/support/toi/eos-4-25-1f/14628-ip-locking-release-updates .\n\nThis is compatible with the following platforms only:\n\n\u00a0\n\n  *  CCS-720XP\n  *  CCS-710P\n  *  CCS-720DP\n  *  CCS-722XPM\n  *  DCS-7010TX\n  *  DCS-7050CX3\n  *  DCS-7050SX3\n  *  CCS-710XP\n  *  CCS-720DF\n  *  CCS-720DT\n  *  CCS-720XDM\n  *  CCS-720XPM\n  *  CCS-755\n  *  CCS-758\n  *  DCS-7050CX3M\n  *  DCS-7050TX3\n  *  DCS-7304\n  *  DCS-7308\n  *  7300X3\n\n\n\n\nUntrusted ports can be locked with the following configuration:\n\n\n\nswitch(config)# address locking\nswitch(config-address-locking)# locked-address ipv4 enforcement disabled\nswitch(config-address-locking)# locked-address ipv6 enforcement disabled\n  \nswitch(config)# int et 5\nswitch(config-if-Et5)# address locking ?\n\u00a0\u00a0ipv4\u00a0 Enable address locking for IPv4\n\u00a0\u00a0ipv6\u00a0 Enable address locking for IPv6\n\u00a0\u00a0\u003ccr\u003e\nswitch(config-if-Et5)# address locking ipv4\nswitch(config-if-Et5)# address locking ipv6\n\n\n\u00a0\n\n\n\nThe above configuration can be validated using the following output:\n\n\n\nswitch# show address locking\nIP Locking is active\nLogging events: None\nBindings persistence is enabled\nBindings last backup time: Not Available\nConfigured IPv4 Interfaces: \u00a0 \u00a0 \u00a0 Et5\nConfigured IPv6 Interfaces: \u00a0 \u00a0 \u00a0 Et5\nConfigured IPv4 VLANs:\nConfigured IPv6 VLANs:\n  \nInterface Status\nInterface\u00a0 \u00a0 \u00a0 \u00a0 IPv4 \u00a0 \u00a0 \u00a0 IPv6\n---------------- ---------- -------------------\nEthernet5\u00a0 \u00a0 \u00a0 \u00a0 yes* \u00a0 \u00a0 \u00a0 yes*\n  \n* Locked address enforcement is disabled\n\n\n\u00a0\n\n\n\nWith the above configuration applied, DHCP traffic from untrusted ports can be blocked and the following output reflects the packet drops:\n\n\n\nswitch#show address locking counters detail\nAction\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Count\n--------------------------------- -----\nARP (0.0.0.0) PERMIT\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\nDHCP from client to server PERMIT \u00a0 \u00a0 0\nDHCP from server DROP \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4\n\n\n\u00a0\n\n\n\nIn releases prior to EOS-4.35.0F, \u201cshow address locking counters detail\u201d command is not available. Instead, run \u201cshow platform trident tcam detail\u201d and grep for these IP Locking counters.\n\n\n\nswitch#show platform trident tcam detail\n=== TCAM detail for switch Linecard0/0 ===\nGroups programmed in IFP\n...\nTCAM group 129 copy 0 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u00a0\u00a0IP Locking v4 uses 3 entries.\n\u00a0\u00a0\u00a0\u00a00x0000005c\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - Unknown ARP permit rule\n\u00a0\u00a0\u00a0\u00a00x0000005d\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP permit from client\n\u00a0\u00a0\u00a0\u00a00x00000060\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4 hits - DHCP drop from server\nTCAM group 129 copy 1 in PIPE 0 uses 3 entries and can use up to 12282 more.\n\u00a0\u00a0IP Locking v4 uses 3 entries.\n\u00a0\u00a0\u00a0\u00a00x0800005c\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - Unknown ARP permit rule\n\u00a0\u00a0\u00a0\u00a00x0800005d\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP permit from client\n\u00a0\u00a0\u00a0\u00a00x08000060\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0 hits - DHCP drop from server"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-73437",
    "datePublished": "2026-09-15T21:02:49.314Z",
    "dateReserved": "2026-08-12T16:39:35.976Z",
    "dateUpdated": "2026-09-15T21:02:49.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73437\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2026-09-15T22:16:58.220\",\"lastModified\":\"2026-09-15T22:16:58.220\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.\"}],\"affected\":[{\"source\":\"psirt@arista.com\",\"affectedData\":[{\"vendor\":\"Arista Networks\",\"product\":\"EOS\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"710 Series\",\"720D Series\",\"720XP/722XPM Series\",\"750X Series\",\"7010TX Series\",\"7020R/R4 Series\",\"7130 Series running EOS\",\"7170 Series\",\"7050X3/X4 Series\",\"7060X/X2/X4/X5/X6 Series\",\"7260X/X3 Series\",\"7280R/R2/R3/R4 Series\",\"7300X/X3 Series\",\"7320X Series\",\"7358X4 Series\",\"7368X4 Series\",\"7388X5 Series\",\"7500R/R2/R3 Series\",\"7800R3/R4 Series\",\"7700R4 Series\",\"AWE 5000 Series\",\"AWE 7200R Series\",\"CloudEOS\",\"cEOS-lab\",\"vEOS-lab\",\"CloudVision eXchange\",\"virtual or physical appliance\"],\"versions\":[{\"version\":\"4.36.0\",\"lessThanOrEqual\":\"4.36.1F\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"4.36.2F\",\"status\":\"unaffected\"}]},{\"version\":\"4.35.0\",\"lessThanOrEqual\":\"4.35.5M\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"4.35.6M\",\"status\":\"unaffected\"}]},{\"version\":\"4.34.0\",\"lessThanOrEqual\":\"4.34.7.1M\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"4.34.8M\",\"status\":\"unaffected\"}]},{\"version\":\"4.33.0\",\"lessThanOrEqual\":\"4.33.9M\",\"versionType\":\"custom\",\"status\":\"affected\",\"changes\":[{\"at\":\"4.33.10M\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156\",\"source\":\"psirt@arista.com\"}]}}"
  }
}

FKIE_CVE-2026-73437

Vulnerability from fkie_nvd - Published: 2026-09-15 22:16 - Updated: 2026-09-15 22:16

Severity

9.6 (Critical) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@arista.com	https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange",
            "virtual or physical appliance"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.36.2F",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.35.6M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.34.8M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.34.7.1M",
              "status": "affected",
              "version": "4.34.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.33.10M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.33.9M",
              "status": "affected",
              "version": "4.33.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@arista.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients."
    }
  ],
  "id": "CVE-2026-73437",
  "lastModified": "2026-09-15T22:16:58.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "psirt@arista.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "psirt@arista.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-15T22:16:58.220",
  "references": [
    {
      "source": "psirt@arista.com",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156"
    }
  ],
  "sourceIdentifier": "psirt@arista.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "psirt@arista.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QG3P-GW27-MVMJ

Vulnerability from github – Published: 2026-09-16 00:31 – Updated: 2026-09-16 00:31

Details

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

6.5 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-73437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-15T22:16:58Z",
    "severity": "MODERATE"
  },
  "details": "On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.",
  "id": "GHSA-qg3p-gw27-mvmj",
  "modified": "2026-09-16T00:31:28Z",
  "published": "2026-09-16T00:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73437"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24712-security-advisory-0156"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73437 (GCVE-0-2026-73437)

FKIE_CVE-2026-73437

GHSA-QG3P-GW27-MVMJ

Tags

Sightings

Nomenclature