Arista Networks has disclosed a security vulnerability affecting its Extensible Operating System (EOS) that is being actively exploited, but the company has decided not to release a software patch for the issue. Instead, customers are being advised to implement the available mitigations and review their network configurations to reduce potential exposure.
The vulnerability impacts specific EOS deployments that use tunnel termination features, including technologies such as GRE and VXLAN. According to Arista, the flaw stems from insufficient validation of encapsulated protocol types during packet decapsulation. Under certain conditions, a device configured to process one type of tunneled traffic may also accept and decapsulate traffic using a different protocol directed to the same IP address.
This behavior could allow unexpected network traffic to traverse environments where it would not normally be permitted, potentially bypassing intended segmentation controls. While exploitation requires particular configurations to be present, the issue has attracted attention because it has already been observed in real-world attacks.
Arista emphasized that not all devices running EOS are vulnerable. The exposure is limited to systems configured with affected tunneling features. Organizations that do not use these capabilities are not impacted by the flaw. For affected environments, the company recommends reviewing tunnel configurations, limiting unnecessary exposure, and applying the mitigation measures outlined in its security advisory.
The vendor’s decision not to issue a patch is unusual, particularly given the vulnerability’s exploitation status. Instead, Arista maintains that the available mitigations adequately address the risk for affected deployments. Customers are encouraged to evaluate their network architectures, ensure that only required tunneling protocols are enabled, and closely monitor network traffic for anomalies that could indicate attempted exploitation.
Security teams should also assess whether vulnerable devices play a critical role in network segmentation or interconnection between environments. In such cases, additional defensive measures may be warranted to minimize the risk of unauthorized traffic movement across the network. As organizations continue to rely on complex tunneling technologies to support modern infrastructure, the incident serves as a reminder of the importance of regularly reviewing network configurations and limiting unnecessary attack surface.