CVE-2026-73437
published 2026-09-15CVE-2026-73437: On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access…
PriorityP359critical9.6CVSS 3.1
AVAACLPRNUINSCCHIHAH
EPSS
0.21%
9.8th percentile
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista_networks | eos | 4.33.0 – 4.33.9M | — |
| arista_networks | eos | 4.34.0 – 4.34.7.1M | — |
| arista_networks | eos | 4.35.0 – 4.35.5M | — |
| arista_networks | eos | 4.36.0 – 4.36.1F | — |
CVSS provenance
nvdv3.19.6CRITICALCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.06.5MEDIUMCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Arista EOS up to 4.33.9M/4.34.7.1M/4.35.5M/4.36.1F DHCP denial of service (WID-SEC-2026-3287)
vuldb·2026-09-17·CVSS 9.6
CVE-2026-73437 [CRITICAL] Arista EOS up to 4.33.9M/4.34.7.1M/4.35.5M/4.36.1F DHCP denial of service (WID-SEC-2026-3287)
A vulnerability labeled as very critical has been found in Arista EOS up to 4.33.9M/4.34.7.1M/4.35.5M/4.36.1F. This issue affects some unknown processing of the component DHCP Handler. Executing a manipulation can lead to denial of service.
This vulnerability appears as CVE-2026-73437. The attack may be performed from remote. There is no available exploit.
GHSA
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from a
ghsa_unreviewed·2026-09-16
CVE-2026-73437 [MEDIUM] CWE-345 On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from a
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-15
Published