by Kastro
Paper/Archive/CVE-2026-73453

CVE-2026-73453

Arista Networks EOS — Security Advisory 0174

EPSS 0.7%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 53.0.530 × 2010.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Affected

ProductAffectedFixed inSource
EOS4.36.0F – 4.36.1F–CNA
EOS4.35.0F – 4.35.5M–CNA
EOS4.34.0F – 4.34.7M–CNA
EOS4.33.0F – < 4.34.0F4.34.0FCNA
EOS4.32.0F – < 4.33.0F4.33.0FCNA
EOS4.31.0F – < 4.32.0F4.32.0FCNA
EOS4.30.0F – < 4.31.0F4.31.0FCNA
EOS4.29.2F – < 4.30.0F4.30.0FCNA

Scores by source

Arista (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Arista (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryarista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174