CVE-2026-73443: Arista EOS VRRPv2 Replay Attack DoS Vulnerability

CVE-2026-73443 Overview

CVE-2026-73443 is a replay attack vulnerability affecting Arista EOS platforms configured with Virtual Router Redundancy Protocol version 2 (VRRPv2) IP Authentication Header (IP-AH) authentication. An unauthenticated attacker on the same layer 2 network segment can capture legitimate VRRP advertisements and replay them indefinitely. The replayed packets advertise stale VRRP state, preventing backup routers from taking over the virtual gateway when the master router fails. Hosts relying on the virtual gateway address lose connectivity, producing a denial of service condition.

Critical Impact
Attackers with layer 2 adjacency can suppress VRRP failover, stranding hosts behind a non-functional virtual gateway and disrupting network availability.

Affected Products

Arista EOS with VRRPv2 IP-AH authentication configured
Deployments using VRRPv2 for gateway redundancy on shared layer 2 segments
Refer to Arista Security Advisory #0157 for the full list of impacted releases

Discovery Timeline

2026-09-16 - CVE-2026-73443 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73443

Vulnerability Analysis

The vulnerability stems from insufficient replay protection in the VRRPv2 IP-AH authentication implementation on Arista EOS. VRRP advertisements are transmitted periodically by the master router to signal liveness to backup routers on the same broadcast domain. IP-AH authentication provides cryptographic integrity for these advertisements, but it does not guarantee freshness in this implementation. An adjacent attacker can therefore capture a legitimate signed advertisement and retransmit it after the master goes down, tricking backups into remaining in a passive state.

The consequence is a targeted denial of service against network availability. Hosts using the VRRP virtual IP as their default gateway cannot forward traffic once the master fails, because no backup will transition to master state while replayed advertisements continue to arrive.

Root Cause

The root cause is classified under [CWE-294] Authentication Bypass by Capture-Replay. VRRPv2 IP-AH authentication verifies the origin and integrity of an advertisement but does not include a monotonically increasing sequence number, nonce, or timestamp that receivers validate. This design gap allows a captured packet to remain indefinitely valid to any listener on the segment.

Attack Vector

Exploitation requires layer 2 adjacency to the VRRP-enabled segment. An attacker passively captures a signed VRRP advertisement using a standard packet sniffer. The attacker then retransmits the captured frame at the VRRP advertisement interval, either continuously or timed to coincide with a master failure. Backup routers accept the replayed advertisement as valid and defer taking over the virtual IP, resulting in gateway unavailability for downstream hosts.

No authentication material, cryptographic key, or elevated privilege is required. The attack is limited to attackers with access to the local broadcast domain.

Detection Methods for CVE-2026-73443

Indicators of Compromise

Duplicate VRRPv2 advertisements observed on the segment with identical authentication data over extended time windows
Backup VRRP routers logging that the master remains reachable while the actual master interface is down or unreachable
Loss of default gateway reachability for hosts served by the virtual IP despite VRRP peers reporting a healthy master
Unexplained flapping or stalled VRRP state transitions in EOS logs

Detection Strategies

Correlate VRRP advertisement traffic captures with physical link state and control-plane health of the advertised master router
Baseline VRRP advertisement source MAC addresses and alert on discrepancies against expected master router interfaces
Deploy port mirroring or SPAN sessions on VRRP segments and inspect for repeated identical AH-authenticated payloads

Monitoring Recommendations

Ingest EOS syslog and VRRP state-change events into a centralized logging platform for correlation
Monitor gateway reachability from downstream hosts using synthetic ICMP or ARP probes
Alert on VRRP master role stability anomalies, such as a master remaining active despite interface-down events on the advertised router

How to Mitigate CVE-2026-73443

Immediate Actions Required

Review Arista Security Advisory #0157 to identify fixed EOS releases and apply the vendor patch
Where feasible, migrate from VRRPv2 IP-AH authentication to VRRPv3, which does not rely on the deprecated IP-AH scheme
Restrict physical and logical access to VRRP-enabled layer 2 segments to trusted devices only

Patch Information

Arista has published remediation guidance in Security Advisory #0157. Administrators should upgrade affected EOS versions to a fixed release identified in the advisory. Consult the advisory for exact fixed version numbers and applicable hardware platforms.

Workarounds

Disable VRRPv2 IP-AH authentication and rely on network segmentation controls if a fixed EOS release cannot be deployed immediately
Enforce strict port security, 802.1X, or MACsec on access ports connected to VRRP segments to limit adjacent attacker access
Isolate VRRP segments from user access networks so that only routing infrastructure can transmit on the shared broadcast domain

bash

# Configuration example: review current VRRP configuration on EOS
show vrrp
show vrrp interface <interface>

# Reference Arista Security Advisory #0157 for the recommended fixed release
# and follow the standard EOS upgrade procedure to apply the patch