{"id":"CVE-2026-120974","kind":"vulnerability","aliases":["CVE-2026-120974"],"related":[],"title":"Arista EOS: IPsec replay protection can silently stay inactive on AutoVPN","description":"On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.","summary":"On Arista EOS devices using IPsec AutoVPN with dynamic paths, the configured IPsec replay window may not be applied, so anti-replay protection can be silently off. An attacker may be able to replay previously valid protected traffic, but the flaw does not allow decryption of that traffic.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arista-eos","autovpn","infrastructure","ipsec","network-gear"],"not_affected_if":["no-autovpn","no-dynamic-paths","no-ipsec"],"how_to_check":"- Confirm the device runs Arista EOS with IPsec AutoVPN configured with dynamic paths\n- Check the SA policy replay window setting on the device and whether it is actually applied (`unknown` for the exact command in the sources)","fix":null,"status":"open","published_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:48:02+00:00","updated_at":"2026-11-10T20:48:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T20:48:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: IPsec replay protection can silently stay inactive on AutoVPN","impact":"low","summary":"On Arista EOS devices using IPsec AutoVPN with dynamic paths, the configured IPsec replay window may not be applied, so anti-replay protection can be silently off. An attacker may be able to replay previously valid protected traffic, but the flaw does not allow decryption of that traffic.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","ipsec","autovpn","network-gear"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Replay of previously valid IPsec-protected traffic on the VPN","analyst_note":"Find Arista's advisory and the list of affected and fixed EOS versions; the NVD entry does not give them.","how_to_check":"- Confirm the device runs Arista EOS with IPsec AutoVPN configured with dynamic paths\n- Check the SA policy replay window setting on the device and whether it is actually applied (`unknown` for the exact command in the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-autovpn","no-dynamic-paths","no-ipsec"],"who_is_affected":"Networks running Arista EOS with IPsec AutoVPN using dynamic paths and an SA policy that sets an IPsec replay window. Devices without AutoVPN dynamic paths, or without IPsec, are not described as affected. The sources do not list affected EOS versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4601,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120974':14A,17A '-2026':13A,16A 'abl':59B 'affect':77C,137C 'allow':71B,133C,143C 'anti':48B,106C 'anti-replay':47B,105C 'appli':45B,98C 'arista':1A,19B,28B,80C 'arista-eo':18B 'attack':56B 'autovpn':11A,21B,33B,84C 'configur':38B,86C,91C,118C 'contrari':123C 'cve':12A,15A 'decrypt':72B,134C 'devic':30B 'dynam':35B,88C 'eo':2A,20B,29B,81C 'even':113C 'expect':100C,128C 'featur':85C 'flaw':68B 'gear':26B 'inact':9A,112C 'infrastructur':22B 'ipsec':3A,23B,32B,39B,83C,92C,104C,138C 'issu':130C 'may':42B,57B,95C,109C,142C 'network':25B 'network-gear':24B 'oper':126C 'path':36B,89C 'platform':78C 'polici':122C 'previous':62B,146C 'protect':5A,50B,64B,108C,148C 'replay':4A,40B,49B,61B,93C,107C,144C 'result':103C 'run':79C 'sa':121C 'silent':7A,53B,111C 'stay':8A 'traffic':65B,75B,139C,149C 'use':31B 'valid':63B,147C 'via':119C 'window':41B,94C","nicknames":[],"mitigations":[],"who_affected":"Networks running Arista EOS with IPsec AutoVPN using dynamic paths and an SA policy that sets an IPsec replay window. Devices without AutoVPN dynamic paths, or without IPsec, are not described as affected. The sources do not list affected EOS versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aristaeos","autovpn","infrastructure","ipsec","medium","networkgear"],"campaign_type":null,"search_a":"'-120974':14A,17A '-2026':13A,16A 'arista':1A 'autovpn':11A 'cve':12A,15A 'eo':2A 'inact':9A 'ipsec':3A 'protect':5A 'replay':4A 'silent':7A 'stay':8A","search_b":"'abl':59B 'allow':71B 'anti':48B 'anti-replay':47B 'appli':45B 'arista':19B,28B 'arista-eo':18B 'attack':56B 'autovpn':21B,33B 'configur':38B 'decrypt':72B 'devic':30B 'dynam':35B 'eo':20B,29B 'flaw':68B 'gear':26B 'infrastructur':22B 'ipsec':23B,32B,39B 'may':42B,57B 'network':25B 'network-gear':24B 'path':36B 'previous':62B 'protect':50B,64B 'replay':40B,49B,61B 'silent':53B 'traffic':65B,75B 'use':31B 'valid':63B 'window':41B","search_c":"'affect':77C,137C 'allow':133C,143C 'anti':106C 'anti-replay':105C 'appli':98C 'arista':80C 'autovpn':84C 'configur':86C,91C,118C 'contrari':123C 'decrypt':134C 'dynam':88C 'eo':81C 'even':113C 'expect':100C,128C 'featur':85C 'inact':112C 'ipsec':83C,92C,104C,138C 'issu':130C 'may':95C,109C,142C 'oper':126C 'path':89C 'platform':78C 'polici':122C 'previous':146C 'protect':108C,148C 'replay':93C,107C,144C 'result':103C 'run':79C 'sa':121C 'silent':111C 'traffic':139C,149C 'valid':147C 'via':119C 'window':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120974","severity":null,"published_at":"2026-11-10T20:18:52+00:00","modified_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}