Executive brief
Arista EOS switches with DHCP relay enabled are vulnerable to spoofed DHCP replies from unauthorized servers. An attacker can send crafted DHCP packets that the relay forwards to clients without validating the source, allowing the attacker to inject malicious network configuration (like rogue DNS or gateway settings). This could redirect traffic, intercept communications, or cause service outages for networked devices.
Technical details
The vulnerability is an insufficient data authenticity verification (CWE-345) in the DHCP relay agent. When DHCP relay is configured with helper addresses, the relay forwards DHCP reply packets (DHCPOFFER, DHCPACK, DHCPv6 Relay-Reply) to clients without validating that the source IP matches a configured helper/destination address. An unauthenticated attacker with network access can send spoofed DHCP replies from arbitrary IP addresses; the relay will forward these replies, allowing the attacker to supply malicious DHCP options. Affected EOS versions include 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.7.1M and below (4.34.x), 4.33.9M and below (4.33.x), and all earlier releases. The vulnerability requires DHCP relay to be actively configured with at least one IPv4 or IPv6 helper address; patches and source-address validation configuration are available.
Affected products
- Arista EOS 4.33.9M and below (4.33.x), 4.34.7.1M and below (4.34.x), 4.35.5M and below (4.35.x), 4.36.1F and below (4.36.x), and all prior releases
Timeline
- 2026-09-09: disclosed: Arista Security Advisory 0156 initial release
- 2026-09-15: other: CVE-2026-73437 published