Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
Arista EOS network switches that have a tunnel decapsulation configuration, such as VXLAN, decap-groups, or a GRE tunnel interface, are affected. Because the switches don't verify the tunnel protocol type, they can incorrectly unwrap and forward unexpected tunneled traffic addressed to their decapsulation IP.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- Arista Networks EOS
From 4.35.0 · through 4.35; From 4.34.0 · through 4.34; From 4.33.0 · through 4.33; From 4.32.0 · through 4.32; From 4.31.0 · through 4.31; From * · through 4.30