fevar54/cve-2026-7473---arista-eos-tunnel-decapsulation-bypassVulnerability: On affected Arista EOS platforms with tunnel decapsulation
README.md markdown
This code is ONLY for educational purposes and authorized security testing.
CVE-2026-7473 is a vulnerability in Arista EOS where a switch configured as a tunnel endpoint (VXLAN, GRE, decap-groups) incorrectly decapsulates and forwards unexpected tunneled packets whose destination IP matches the configured decapsulation IP. This occurs because the switch does not check the tunnel protocol type (CWE-1023).
| Field | Value |
|---|---|
| CVE | CVE-2026-7473 |
| CVSS v3.1 | 5.8 (Medium) |
| CVSS v4.0 | 6.8 |
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| CWE | 1023 - Incomplete Comparison with Missing Factors |
| Train | Status |
|---|---|
| 4.36.x | Vulnerable |
| 4.35.x | Vulnerable |
| 4.34.x | Vulnerable |
| 4.33.x | Vulnerable |
| 4.32.x | Vulnerable |
| 4.31.x | Vulnerable |
| 4.30.x | Vulnerable |
| < 4.30.x | Vulnerable |
| Series | Exposure |
|---|---|
| 7020R Series | Completely affected |
| 7280R/R2 Series | Completely affected |
| 7500R/R2 Series | Completely affected |
| 7280R3 Series | Limited exposure (IP-in-IPv6, GUEv6) |
| 7500R3 Series | Limited exposure (IP-in-IPv6, GUEv6) |
| 7800R3 Series | Limited exposure (IP-in-IPv6, GUEv6) |
The device is vulnerable if it meets:
ip decap-group# Verificar VXLAN VTEP
show interfaces vxlan 1
# Verificar GRE tunnel
show interfaces Tunnel0
# Verificar decap-groups
show ip decap-group
🚀 Usage
Installation
bash
git clone https://github.com/username/CVE-2026-7473-Arista-EOS-Tunnel-Bypass
cd CVE-2026-7473-Arista-EOS-Tunnel-Bypass
pip install -r requirements.txt
Scan vulnerable configuration
bash
python3 arista_tunnel_bypass.py -t 10.1.1.1 -d 192.168.1.100 --check-config
Send GRE to switch with VXLAN
bash
python3 arista_tunnel_bypass.py -t 10.1.1.1 -d 192.168.1.100 --exploit vxlan-gre
Send VXLAN to switch with GRE
bash
python3 arista_tunnel_bypass.py -t 10.1.1.1 -d 192.168.1.100 --exploit gre-vxlan
Send all bypass types
bash
python3 arista_tunnel_bypass.py -t 10.1.1.1 -d 192.168.1.100 --exploit all
📊 Exploitation Matrix
Configuration Unexpected Traffic Decapsulates?
VXLAN IPv4 GRE ✅ Yes
VXLAN IPv4 IPoIP ✅ Yes
GRE IPv4 VXLAN ✅ Yes
GRE IPv4 IPoIP ✅ Yes
GRE Decap Group IPoIP ✅ Yes
GUE Decap Group GRE, IPoIP ✅ Yes
IP-in-IP Decap Group GRE, NVGRE, VXLAN ✅ Yes
🔍 Indicators of Compromise (IOCs)
Monitor on switch
bash
# Verificar ACL counters
show mac access-lists bar
# Buscar tráfico inesperado
show log | grep -E "GRE|VXLAN|GUE|unexpected"
On network
- Tunneled traffic appearing in unexpected internal segments
- GRE packets when only VXLAN is configured
- VXLAN packets when only GRE is configured
🛡️ Mitigation
Option 1 - ACL on upstream switches (RECOMMENDED)
bash
# Ejemplo: Permitir solo VXLAN
ip access-list foo
counters per-entry
1 permit udp any host <vxlan-decap-ip> eq 4789
2 deny ip any host <decap-ip>
3 permit ip any any
Option 2 - ACL on decapsulating switch (complex)
- Requires TCAM profile update
- Contact Arista TAC for assistance
📚 References
- Arista Security Advisory 0137
- NVD - CVE-2026-7473
- CISA KEV Catalog
⚖️ Disclaimer
This software is provided "as is". The author is not responsible for misuse. Use it only on authorized systems.