CVE-2026-73437: Arista EOS DHCP Relay DOS Vulnerability

CVE-2026-73437 Overview

CVE-2026-73437 affects Arista Extensible Operating System (EOS) platforms configured with Dynamic Host Configuration Protocol (DHCP) relay. The relay agent forwards DHCP reply packets to clients without validating that the source IP matches a configured helper address. An unauthenticated attacker with adjacent network access can send crafted DHCP replies from arbitrary source addresses, and the relay agent will pass them to clients. Successful exploitation allows the attacker to inject malicious network configuration parameters such as default gateways or DNS servers. This can result in traffic interception, man-in-the-middle (MITM) positioning, or denial of service against affected clients. The weakness maps to [CWE-345] Insufficient Verification of Data Authenticity.

Critical Impact
Attackers on an adjacent network can spoof DHCP responses to redirect client traffic or disrupt network connectivity for downstream clients.

Affected Products

Arista EOS platforms with DHCP relay configured (see Arista Security Advisory #0156 for specific affected versions)
Network segments where the EOS device acts as a DHCP relay agent
Downstream DHCP clients relying on relay-forwarded configuration

Discovery Timeline

2026-09-15 - CVE-2026-73437 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73437

Vulnerability Analysis

The vulnerability is a DHCP protocol validation flaw in the EOS DHCP relay agent. A DHCP relay agent forwards DHCP messages between clients and servers across broadcast domains. Configuration typically defines one or more helper addresses that specify legitimate DHCP servers. On affected EOS versions, the relay agent forwards DHCP reply packets to clients regardless of whether the reply originated from a configured helper address. This missing source-authenticity check enables spoofed DHCP replies to reach clients as if they came from a trusted server. Clients accept the injected parameters and update their network stack accordingly, exposing them to redirection or loss of connectivity.

Root Cause

The root cause is insufficient verification of data authenticity in the DHCP relay processing path. The relay agent does not validate that inbound DHCP reply packets originate from an IP address configured as a helper. Any packet formatted as a valid DHCP reply on the server-facing interface is accepted for forwarding.

Attack Vector

The attacker requires adjacent network access, meaning a foothold on a network segment reachable by the relay agent. The attacker crafts a DHCP reply packet containing attacker-controlled options such as the router option, DNS server option, or lease parameters. The packet is sent from an IP address that is not on the helper list. The relay agent forwards the reply to clients, which apply the malicious configuration. No authentication or user interaction is required.

No public exploit code or proof-of-concept has been published. See the Arista Security Advisory #0156 for vendor technical details.

Detection Methods for CVE-2026-73437

Indicators of Compromise

DHCP reply packets observed on relay-facing interfaces sourced from IP addresses not configured as helper addresses.
Client systems receiving unexpected default gateway, DNS server, or lease-time values.
Sudden clusters of client connectivity failures or traffic redirected through unfamiliar next hops.

Detection Strategies

Capture DHCP traffic on relay uplinks and compare reply source IPs against the configured helper address list.
Correlate DHCP lease events with ARP and routing changes on client subnets to identify anomalous configuration pushes.
Alert when clients acquire DHCP parameters that deviate from the approved server-issued baseline.

Monitoring Recommendations

Forward DHCP relay logs and packet metadata to a centralized analytics platform for continuous inspection.
Enable syslog on EOS DHCP relay events and monitor for reply forwarding from unexpected source addresses.
Track client DHCP lease history to detect repeated reassignment or parameter flapping indicative of spoofing.

How to Mitigate CVE-2026-73437

Immediate Actions Required

Review all EOS devices with DHCP relay enabled and inventory configured helper addresses.
Apply the fixed EOS release identified in Arista Security Advisory #0156 as soon as it is available for your deployment.
Restrict server-facing interfaces so that only traffic from legitimate DHCP servers can reach the relay agent.

Patch Information

Refer to the Arista Security Advisory #0156 for the list of fixed EOS versions and upgrade guidance. Arista typically publishes hotfix scripts and remediated release trains for supported EOS branches.

Workarounds

Use access control lists (ACLs) on relay interfaces to permit DHCP traffic only from configured helper server IP addresses.
Enable DHCP snooping on downstream access switches to filter untrusted DHCP replies before they reach clients.
Segment DHCP server infrastructure onto dedicated VLANs to reduce the adjacent attack surface available to unauthenticated actors.

bash

# Example ACL concept restricting DHCP replies to a known server
# Replace 10.0.0.10 with your configured helper address
ip access-list DHCP-RELAY-INGRESS
   permit udp host 10.0.0.10 eq bootps any
   deny   udp any eq bootps any
   permit ip any any
!
interface Ethernet1
   ip access-group DHCP-RELAY-INGRESS in