CVE-2026-7473
MEDIUM KEVArista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
Title source: cnaExploitation Summary
CVE-2026-7473 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 9, 2026. EIP tracks 1 public exploit from researchers including fevar54.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-7473, which allows bypassing tunnel protocol verification in Arista EOS switches. The exploit crafts and sends various tunnel packets (GRE, VXLAN, GUE, IP-in-IP, NVGRE) to demonstrate improper decapsulation and forwarding.
Description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
Exploits (1)
This repository contains a functional exploit for CVE-2026-7473, which allows bypassing tunnel protocol verification in Arista EOS switches. The exploit crafts and sends various tunnel packets (GRE, VXLAN, GUE, IP-in-IP, NVGRE) to demonstrate improper decapsulation and forwarding.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N