## Summary
Arista EOS devices with IS-IS configured on a broadcast interface are vulnerable to an unauthenticated Layer 2 attacker who can send a crafted IS-IS Hello PDU to tear down an existing IS-IS adjacency. This can disrupt traffic and cause loss of IP reachability for prefixes advertised through the affected adjacency.
## Technical Details
- CVE-2026-73446 (tracked as BUG1840504) affects Arista EOS when IS-IS is configured on a broadcast interface.
- The attacker is unauthenticated and operates in the same Layer 2 domain as the target.
- A crafted IS-IS Hello Protocol Data Unit (PDU) can trigger the device to tear down an established IS-IS adjacency.
- The advisory notes these issues may allow manipulation of IS-IS protocol state and could bypass protections intended by RFC 5304/5310 MD5 or SHA authentication.
- CVSS indicates no privileges required (PR:N) and no user interaction (UI:N), with availability impact (A:H).
## Affected
- Arista EOS with IS-IS configured on a broadcast interface.
- Condition: attacker must be in the same Layer 2 domain.
## Impact
- Traffic disruption.
- Loss of IP reachability for prefixes advertised through the torn-down IS-IS adjacency.
- Confidentiality and integrity impacts are indicated as none (C:N, I:N), while availability is high (A:H).
## Mitigation
1. Ensure IS-IS authentication protections are enabled where applicable (the advisory indicates potential bypass of RFC 5304/5310 MD5/SHA, so treat this as insufficient alone).
2. Restrict Layer 2 adjacency exposure: limit which hosts can reach the EOS device’s IS-IS broadcast segment (e.g., segmentation/ACLs at Layer 2).
3. Apply the vendor’s recommended security update(s) for the advisory 24716 once available for your EOS release.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-696