CVE-2026-73443: On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.33.10M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.34.8M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.35.6M - Upgrade
Upgrade
Arista EOSto a version that resolves this vulnerability.Fixed in 4.36.2F - Configuration
After upgrading to a remediated Arista EOS release, explicitly enable VRRP replay protection by entering: switch(config)#vrrp ipv4 authentication anti-replay
Arista EOS (global configuration) vrrp ipv4 authentication anti-replay = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker must be on the same Layer 2 network segment where VRRP is operating. The attacker also needs to capture a legitimate authenticated VRRPv2 advertisement before replaying it.
Which configurations are affected?
The issue applies to affected platforms running Arista EOS when VRRPv2 IP-AH authentication is configured. The provided information does not establish whether configurations without VRRPv2 IP-AH authentication are affected.
What is the operational impact of a successful replay?
Replayed advertisements can present stale VRRP state and prevent a backup router from assuming the virtual gateway role after the original master fails. This can deny service to hosts that use the virtual gateway address.