CVE-2026-7473

Name of the Vulnerable Software and Affected Versions Arista EOS (affected versions not specified)

Description On platforms running Arista EOS with tunnel decapsulation configurations—such as VXLAN (Virtual Extensible LAN), decap-groups, or GRE (Generic Routing Encapsulation) tunnel interfaces—the switch incorrectly decapsulates and forwards unexpected tunneled packets if the destination IP matches its configured decapsulation IP. This occurs because the switch fails to verify the tunnel protocol type, allowing it to strip and forward any supported tunnel protocol (including GRE, VXLAN, IP-in-IP, NVGRE, and GUE) regardless of the actual configuration. This flaw allows an attacker to bypass network segmentation by crafting double-encapsulated packets to reach protected internal segments without traversing firewalls. This issue has been reported as being exploited in the wild.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the configured decapsulation IP from untrusted networks using Access Control Lists (ACLs) to minimize the risk of exploitation.