CVE-2026-73444

medium

Description

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-80009

Details

Source: Mitre, NVD

Published: 2026-09-15

Updated: 2026-09-16

Risk Information

CVSS v2

Base Score: 3.3

Vector: CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:P

Severity: Low

CVSS v3

Base Score: 4.7

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00299