CVE-2026-73443 PUBLISHED

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef

Assigner: Arista
Reserved: 12.08.2026 Published: 16.09.2026 Updated: 16.09.2026

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS Score: 4.7

Attack Vector	Adjacent Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 5.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Adjacent	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	Low	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Arista Networks
Product	EOS
Versions	Default: unaffected affected from 4.36.0 to 4.36.1F (incl.) affected from 4.35.0 to 4.35.5M (incl.) affected from 4.34.0 to 4.34.7M (incl.) affected from 4.33.0 to 4.33.9M (incl.)

Affected Configurations

In order to be vulnerable to CVE-2026-73443, VRRPv2 must be configured with IP-AH authentication on at least one interface:

switch>show running-config section vrrp interface Ethernet1 vrrp 1 ipv4 version 2 vrrp 1 peer authentication ietf-md5 key-string 7 <key>

If VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure.

Workarounds

Exposure is limited to attackers with access to the layer 2 network segment on which VRRP is running. Restricting physical and logical access to VRRP-enabled segments (for example with port security and by not extending VRRP VLANs to untrusted access ports) reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path.

The below configuration shows how to configure VRRPv3 on VLAN 20:

switch(config)# interface vlan 20 switch(config-if-vl20)# vrrp 1 ipv4 version 3

Solutions

The recommended resolution is to upgrade to a remediated software version at your earliest convenience.

Important: Upgrading alone is not sufficient. The replay protection introduced by the fix is disabled by default and must be explicitly enabled with the following new global configuration command after upgrading to a remediated release:

switch(config)#vrrp ipv4 authentication anti-replay

CVE-2026-73443 has been fixed in the following releases:

4.36.2F and later releases in the 4.36.x train
4.35.6M and later releases in the 4.35.x train
4.34.8M and later releases in the 4.34.x train
4.33.10M and later releases in the 4.33.x train

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157

Problem Types

CWE-294 Authentication Bypass by Capture-replay CWE

Impacts

CAPEC-60 Replay Attacks