The match key is short by one field. On the affected platforms, a packet whose outer destination IP equals the configured decapsulation address gets stripped and forwarded on its inner header, because the switch does not verify the tunnel protocol type [6]. Arista files this as CWE-1023, incomplete comparison with missing factors [4], which is the honest classification: the comparison that decides whether to decapsulate consults the address and stops.
That is why the listener line in the detection output is not a boundary. The example prints "Listening on UDP port 4789" [16], and 4789 is where VXLAN is expected, but a device configured to decapsulate one tunnel type will also accept other tunnel protocols sent to the same IP, with some cases needing extra protocol-specific configuration [11]. Arista adds that the inner header can be IPv4 or IPv6 in every scenario [12], so an IPv4-only service network is not excluded by addressing family.
The scoring is 5.8 under CVSSv3.1 and 6.8 under CVSSv4.0 [2][3], which reads low for something already reported as exploited [7], and the vector is more useful than the number. AV:N/AC:L/PR:N/UI:N is remote, unauthenticated, no user interaction, low complexity. C:N and A:N say the switch neither leaks nor falls over. I:L with S:C puts the integrity damage on a component other than the vulnerable one [19]. In operational terms, nothing breaks on the switch, and a stranger gets one forwarding decision per packet into whatever sits behind the tunnel edge. The reporters are four Comcast engineers, Scott Christiansen, Lukas Peitz, Rich Compton and Jonathan Davis [8], which is an operator's vantage point rather than a lab's.
Now the version list. Trains 4.30.x through 4.36.x are named individually, which is seven, and the list then adds all releases in trains older than 4.30.x and all releases in trains newer than 4.36.x [9]. Seven named plus both open ends leaves no release excluded [18]. A list that closes with everything newer than the current train does save the reader the trouble of checking.
So the discriminator is configuration, and it splits by silicon. Every scenario in the advisory's table applies to the 7020R, 7280R/R2 and 7500R/R2 series [13]. On the 7280R3, 7500R3 and 7800R3, only the IP-in-IPv6 and GUE IPv6 decap group cases apply [14]. One CVE is tracked under two bug numbers, BUG1086442 and BUG1519884 [5], and the advisory does not say which platform group each one covers.
Inventory has to run per device. The command Arista supplies prints "Source interface is <interface> and is active with <IP>" when the box is a VTEP, and that IP is the termination address that makes it potentially impacted [15]. A GRE tunnel endpoint or an ip decap-group puts a decapsulation IP on the box just as effectively [10]. Being out of scope means no EOS device in the estate terminates a tunnel, and that is a claim about running configuration, checked box by box. The version list will not check it for you.
