CVE-2026-73458 in EOS
Summary
by MITRE • 09/15/2026
On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified affects Arista EOS platforms where authenticated Bidirectional Forwarding Detection sessions are actively configured. Bidirectional Forwarding Detection is a critical protocol used for rapid failure detection of the path between two forwarding engines, operating independently of specific routing protocols and media. In this scenario, an attacker capable of sending specially crafted packets to the affected device can trigger a state change that causes one or more BFD sessions to transition to a down state. This exploitation does not require high privileges on the target system but relies on network-level access to inject malicious traffic into the communication channel between the local router and its BFD peer. The core technical flaw lies in how the EOS software processes incoming authenticated packets, likely involving an improper validation or handling mechanism that leads to a session termination rather than rejecting the malformed input gracefully.
The operational impact of this vulnerability is significant due to the integral role BFD plays in modern network infrastructure. Routing protocols such as Open Shortest Path First and Border Gateway Protocol often rely on BFD for sub-second failure detection, allowing them to converge much faster than they would using standard hello timers alone. When a BFD session unexpectedly goes down, these routing protocols interpret this signal as a link or neighbor failure. Consequently, the affected router will withdraw routes associated with that peer from its forwarding table and trigger reconvergence processes across the network. This can lead to substantial traffic loss, blackholing of data flows, and potential instability in the broader network topology as other routers react to the perceived change in reachability.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation, as the system fails to adequately sanitize or verify the structure of incoming packets before processing them for session state changes. Furthermore, within the MITRE ATT&CK framework, this behavior is consistent with techniques that disrupt service availability by manipulating network control plane protocols, potentially categorized under resource hijacking or impact via denial of service mechanisms targeting specific infrastructure components rather than general system resources. The attack vector typically involves remote exploitation if the attacker has access to a segment where BFD traffic flows, making it a relevant concern for both internal and perimeter security postures depending on segmentation strategies.
Mitigation strategies should prioritize immediate patching with vendor-provided updates that address the parsing logic flaw in the BFD implementation. Until patches are applied, network administrators can implement strict Access Control Lists to restrict BFD packet sources only to known, trusted peer IP addresses, thereby limiting the attack surface for unauthorized actors. Additionally, enabling authentication mechanisms such as MD5 or SHA-HMAC for BFD sessions adds a layer of integrity checking that may prevent crafted packets from being processed if they lack valid cryptographic signatures, although this depends on whether the vulnerability bypasses these checks entirely. Regular monitoring of routing protocol adjacency states and BFD session logs can also aid in early detection of such disruptions, allowing for rapid incident response to minimize network downtime.