CVE-2026-73453 in EOS
Summary
by MITRE • 09/16/2026
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The discovery of a critical remote code execution flaw within the P4Runtime implementation on Arista EOS highlights significant risks associated with network programmability interfaces when improperly secured or configured. The vulnerability resides in the handling of packets during the initialization phase of a P4Runtime session, which is an interface standard defined by the P4 Consortium to allow external controllers to program packet processing pipelines in switches and routers. Although P4Runtime is disabled by default on Arista EOS platforms, any deployment that enables this feature exposes network infrastructure to severe compromise if access controls are not rigorously enforced. The core technical flaw allows an unauthenticated client to craft a malicious packet that triggers arbitrary code execution within the switch's control plane software. This capability effectively grants the attacker complete administrative control over the compromised device, bypassing traditional authentication mechanisms due to the nature of the session initiation process and potential buffer handling errors or logic flaws in the parsing routines.
From an operational perspective, achieving remote code execution on a network switch is catastrophic for infrastructure integrity. An adversary with such access can manipulate forwarding tables, intercept traffic, perform man-in-the-middle attacks, or pivot laterally into internal networks by altering routing protocols and ACLs. The impact extends beyond simple data exfiltration to the potential disruption of critical services dependent on stable network connectivity. Since P4Runtime is often used in software-defined networking environments for dynamic policy enforcement, compromising this interface undermines the trust model of SDN architectures where controllers are expected to manage infrastructure securely. The fact that Arista discovered this internally and reports no known malicious exploitation suggests it may be a theoretical risk or one requiring specific configuration states, yet its severity remains high due to the unauthenticated nature of the initial vector.
To mitigate this vulnerability, organizations must ensure that P4Runtime is disabled unless absolutely necessary for their network architecture. If P4Runtime functionality is required, strict access control lists should be applied at the network perimeter and within internal segments to restrict connectivity to authorized management stations only. Implementing mutual TLS authentication or other strong credential-based mechanisms before any session initiation can prevent unauthenticated clients from reaching the vulnerable code paths. Additionally, keeping Arista EOS firmware updated with the latest security patches provided by the vendor is essential to address underlying implementation flaws in the P4Runtime stack. Network monitoring solutions should be configured to detect anomalous traffic patterns associated with P4Runtime sessions originating from unauthorized sources, providing an additional layer of defense-in-depth against potential exploitation attempts targeting this specific interface.