On Arista EOS devices that have a tunnel decapsulation configuration—such as VXLAN, decap-groups, or GRE interfaces—the switch incorrectly treats any tunneled packet whose destination IP matches the configured decapsulation IP as a valid tunnel, regardless of protocol. As a result, packets bearing an unexpected tunnel type can be decapsulated and forwarded into the switch’s routing tables. The primary impact is the potential injection of arbitrary traffic into the network, which could be used for reconnaissance, traffic hijacking, or denial of service if the payload carries malicious content.

Affected platforms are any Arista Networks EOS switches configured with tunnel decapsulation. The advisory indicates that the issue is present on all EOS releases where such decapsulation is implemented. No specific version range is listed, so any current or recent release with this feature is likely affected.

The CVSS score of 6.9 places this vulnerability in the moderate range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread, automated exploitation detected. However, the advisory states the issue has been exploited in the wild, implying that attackers can remotely craft tunneling traffic to a decapsulation IP from outside the device. The attack vector is inferred to be a network‑layer threat, as an adversary can send crafted packets to the IP address configured for decapsulation. The lack of protocol validation permits the switch to forward non‑configurable tunnel traffic, increasing the risk of data exfiltration or traffic diversion.