CVE-2026-73446 in EOS
Summary
by MITRE • 09/16/2026
On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described involves a denial-of-service condition within the Intermediate System-to-Intermediate System routing protocol implementation on Arista EOS platforms where IS-IS is configured on broadcast interfaces. An unauthenticated attacker, who possesses network connectivity to the affected device, can exploit this flaw by transmitting a specifically crafted IS-IS Hello Protocol Data Unit. This malicious packet triggers an internal error or state machine failure within the router's control plane, causing it to abruptly terminate established adjacencies with neighboring routers. The core technical flaw lies in the insufficient validation of incoming hello packets against expected parameters for broadcast network types, allowing malformed data to disrupt normal protocol operation without requiring authentication credentials.
The operational impact of this vulnerability is significant as IS-IS serves as a critical interior gateway protocol responsible for maintaining routing tables and ensuring IP reachability across complex networks. When an adjacency is torn down due to the crafted packet, the affected router loses its connection to one or more neighbors in that broadcast segment. This disruption leads directly to traffic loss because routes learned through the compromised adjacency are withdrawn from the routing table. Consequently, other devices relying on these prefixes may experience connectivity failures, leading to service outages and potential network instability until the adjacency is manually restored or automatically re-established if the attack ceases.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately sanitize or verify the structure of incoming IS-IS hello packets before processing them. It also corresponds to CWE-486 Comparison Against Class without Type Check in some interpretations where type-specific handling is bypassed by malformed data. In terms of offensive security frameworks, this attack vector maps to MITRE ATT&CK technique T1498 Network Denial of Service, specifically sub-technique T1498.003 which involves flooding or exploiting protocol weaknesses to disrupt availability. The lack of authentication requirement places it in the category of attacks that do not require prior access privileges beyond basic network layer connectivity.
Mitigation strategies should prioritize implementing strict input validation mechanisms within the routing process and ensuring that IS-IS hello packets are checked against defined standards before adjacency state changes occur. Administrators can mitigate this risk by applying vendor-provided software updates or patches that address the specific parsing logic flaw in the broadcast interface handler. Additionally, deploying access control lists to restrict who can send IS-IS hellos to authorized peers only reduces the attack surface significantly since unauthenticated remote attackers are blocked from reaching the vulnerable code path. Enabling authentication on IS-IS adjacencies using MD5 or SHA-1 hashes further prevents unauthorized devices from injecting malicious PDUs even if they reach the interface, although this does not fix the underlying parsing bug it merely limits exposure to authenticated peers who must possess valid keys.