CVE-2026-73437: On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.33.10M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.34.8M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.35.6M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.36.2F - Configuration
Under dhcp relay mode, enable reply source-address validation: use `switch(config)# dhcp relay` then `switch(config-dhcp-relay)# reply source-address validation`.
Arista EOS DHCP relay reply source-address validation (CLI knob under dhcp relay mode) = enabled
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Affected Arista EOS platforms are exposed when DHCP relay is configured. Clients that receive DHCP replies through the relay may be affected by malicious network configuration parameters.
What does an attacker need to exploit it?
An unauthenticated attacker needs network access and must be able to send a crafted DHCP reply packet to the relay. The packet can originate from an IP address that is not configured as a DHCP helper or destination address.
What could indicate active exploitation?
Unexpected DHCP-provided network settings on clients, such as altered configuration parameters, may indicate malicious replies were forwarded. Resulting symptoms can include traffic interception or denial of service affecting DHCP clients.