Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Summary

Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

Remediation

1. Inventory every Arista Extensible Operating System deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.
3. Review logs from before the change for signs of exploitation.

References

• Advisoryhttps://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137
• Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-7473
• Advisoryhttps://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137
• Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473