CVE-2026-2379: Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled

Synopsis

This is a sequence number mismatch vulnerability in Arista EOS affecting hardware IPsec tunnel handling. When anti-replay protection is disabled, physical interface flaps or certain agent restarts can trigger IPsec tunnel re-establishment using existing Security Associations, causing sequence number desynchronization between tunnel endpoints and resulting in unstable or disrupted encrypted communications. The vulnerability is reachable over the network without any authentication, and successful exploitation enables an attacker to read encrypted traffic by exploiting the weakened anti-replay state. A patched-image rebuild at versions 4.28.0, 4.29.0, 4.30.0, and 4.31.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected EOS device over the network to exploit the desynchronized IPsec tunnel state.

• AuthenticationNot required

  No credentials or prior account access are needed; the vulnerability is exploitable by an unauthenticated network actor.

• Victim interactionNot required

  No action from a user or administrator on the target device is required to trigger exploitation once the tunnel is in a mismatched sequence number state.

• Attack complexityDetail

  While the exploit itself requires no special conditions on the attacker's side (AC:L), a prerequisite environmental condition exists (AT:P): the affected device must have anti-replay disabled and must have experienced an interface flap or agent restart to enter the vulnerable state.

Blast Radius

• An attacker gains the ability to read the contents of traffic that should have been protected by IPsec encryption, exposing confidential data in transit across affected tunnels.
• Confidentiality of all data flowing through the affected IPsec tunnels is compromised; this includes any application payloads, credentials, or session tokens transmitted over those tunnels.
• Integrity and availability of the tunnel traffic are not directly impacted according to the CVSS scoring, but loss of confidentiality on encrypted overlay traffic can undermine the security guarantees of the broader network segment relying on those tunnels.