CVE-2026-7473: arista eos

csirt@kutim:~/threat-intel/cve/CVE-2026-7473

CVSS 5.8 · Medium KEV · sudah dieksploitasi EPSS 0,65%

Kerentanan Incomplete Comparison with Missing Factors pada arista eos. Skor CVSS 3.1 5.8 (Medium) menurut arista.com. Masuk katalog KEV CISA pada 9 Juni 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Rincian

Terbit di NVD: 5 Juni 2026
Terakhir diubah: 7 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 5.8 (Medium), sumber arista.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1023: Incomplete Comparison with Missing Factors
EPSS (30 hari): 0,65% peluang dieksploitasi; lebih tinggi dari 49,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Masuk KEV: 9 Juni 2026
Tenggat CISA: 23 Juni 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
arista	eos	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 mitigasi · advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473 pemerintah AS
https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 8 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.