Search
Find a vulnerability
Search criteria
187 vulnerabilities
CVE-2026-121371 (GCVE-0-2026-121371)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:10 – Updated: 2026-11-10 22:02
VLAI
EPSS
VEX
Title
Security Advisory 0218
Summary
On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:22 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.3M
(custom)
Affected: 4.35.0F , ≤ 4.35.7M (custom) Affected: 4.34.0F , ≤ 4.34.9M (custom) Affected: 4.33.0F , ≤ 4.33.11M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 1.0.0 , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T21:22:30.414859Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T22:02:11.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.3M",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.7M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.9M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.11M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003eshow management api http-commands \nEnabled: Yes\nHTTPS server: running, set to use port 443\nHTTP server: running, set to use port 80\n...\n\nswitch#show running-config all| sect http-server\nmanagement http-server\n ...\n default-services\n ...\n\nOr:\n\nswitch#show running-config all| sect http-commands\nmanagement api http-commands\n ...\n default-services\n ...\u003c/pre\u003e"
}
],
"value": "switch\u003eshow management api http-commands \nEnabled: Yes\nHTTPS server: running, set to use port 443\nHTTP server: running, set to use port 80\n...\n\nswitch#show running-config all| sect http-server\nmanagement http-server\n ...\n default-services\n ...\n\nOr:\n\nswitch#show running-config all| sect http-commands\nmanagement api http-commands\n ...\n default-services\n ..."
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:10:01.905Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218"
}
],
"source": {
"advisory": "Security Advisory 0218",
"defects": [
"2048764"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0218",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(config)#management http-server \nswitch(config-mgmt-http-server)#no default-services\n\nswitch#show running-config | sect http-server\nmanagement http-server\n protocol http\n no default-services\n\nOr:\n\nswitch(config)#management api http-commands \nswitch(config-mgmt-api-http-cmds)#no default-services \n\nswitch#show running-config | sect http-commands\nmanagement api http-commands\n protocol http\n no default-services\n no shutdown\u003c/pre\u003e"
}
],
"value": "switch(config)#management http-server \nswitch(config-mgmt-http-server)#no default-services\n\nswitch#show running-config | sect http-server\nmanagement http-server\n protocol http\n no default-services\n\nOr:\n\nswitch(config)#management api http-commands \nswitch(config-mgmt-api-http-cmds)#no default-services \n\nswitch#show running-config | sect http-commands\nmanagement api http-commands\n protocol http\n no default-services\n no shutdown"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121371",
"datePublished": "2026-11-10T20:10:01.905Z",
"dateReserved": "2026-11-03T11:27:14.150Z",
"dateUpdated": "2026-11-10T22:02:11.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121370 (GCVE-0-2026-121370)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:10 – Updated: 2026-11-10 22:02
VLAI
EPSS
VEX
Title
Security Advisory 0224
Summary
On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 21:23 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.34.0F , ≤ 4.34.1F
(custom)
Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.30.0F , < 4.31.0F (custom) Affected: 4.29.2F , < 4.30.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121370",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T21:23:15.251420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T22:02:12.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"750X Series"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.34.1F",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
},
{
"lessThan": "4.31.0F",
"status": "affected",
"version": "4.30.0F",
"versionType": "custom"
},
{
"lessThan": "4.30.0F",
"status": "affected",
"version": "4.29.2F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003eshow ptp\nPTP Mode: Boundary Clock\nPTP Profile: Default ( IEEE1588 )\nClock Identity: XX:XX:XX:XX:XX:XX:XX:XX\nGrandmaster Clock Identity: XX:XX:XX:XX:XX:XX:XX:XX\nNumber of slave ports: 0\nNumber of master ports: 1\nOffset From Master (nanoseconds): 0\nMean Path Delay (nanoseconds): 0\nSteps Removed: 0\nSkew (estimated local-to-master clock frequency ratio): 1.0\n Interface State Transport Delay \n Mechanism\n--------------- ------------ --------------- ---------\n Et1 Master ipv4 e2e\u003c/pre\u003e"
}
],
"value": "switch\u003eshow ptp\nPTP Mode: Boundary Clock\nPTP Profile: Default ( IEEE1588 )\nClock Identity: XX:XX:XX:XX:XX:XX:XX:XX\nGrandmaster Clock Identity: XX:XX:XX:XX:XX:XX:XX:XX\nNumber of slave ports: 0\nNumber of master ports: 1\nOffset From Master (nanoseconds): 0\nMean Path Delay (nanoseconds): 0\nSteps Removed: 0\nSkew (estimated local-to-master clock frequency ratio): 1.0\n Interface State Transport Delay \n Mechanism\n--------------- ------------ --------------- ---------\n Et1 Master ipv4 e2e"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:10:01.435Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25046-security-advisory-0224"
}
],
"source": {
"advisory": "Security Advisory 0224",
"defects": [
"1860051"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0224",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch# platform trident Linecard* diag mod MMU_MAX_BUCKET_QLAYER 1 1 THD_SEL=0x4d REFRESH=0x28\nswitch# platform trident Linecard* diag mod MMU_MIN_BUCKET_QLAYER 1 1 THD_SEL=0x10 REFRESH=0x8\n\nNote: If PTP is currently enabled on any interfaces, disable it on those interfaces before running the mitigation commands, then re-enable it afterward.\n\nTo disable PTP on an interface:\nswitch(config-if)# no ptp enable\n\nNote: These settings are not persistent. They must be re-applied after any forwarding plane reset or line card replacement.\u003c/pre\u003e"
}
],
"value": "switch# platform trident Linecard* diag mod MMU_MAX_BUCKET_QLAYER 1 1 THD_SEL=0x4d REFRESH=0x28\nswitch# platform trident Linecard* diag mod MMU_MIN_BUCKET_QLAYER 1 1 THD_SEL=0x10 REFRESH=0x8\n\nNote: If PTP is currently enabled on any interfaces, disable it on those interfaces before running the mitigation commands, then re-enable it afterward.\n\nTo disable PTP on an interface:\nswitch(config-if)# no ptp enable\n\nNote: These settings are not persistent. They must be re-applied after any forwarding plane reset or line card replacement."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121370",
"datePublished": "2026-11-10T20:10:01.435Z",
"dateReserved": "2026-11-03T11:27:14.150Z",
"dateUpdated": "2026-11-10T22:02:12.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121369 (GCVE-0-2026-121369)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:10 – Updated: 2026-11-13 16:42
VLAI
EPSS
VEX
Title
Security Advisory 0225
Summary
On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 16:42 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.34.2F , ≤ 4.34.7M
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.36.0F , ≤ 4.36.1M (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T16:42:27.455014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:42:38.757Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"750X Series (CCS-750XM-48TX-LC, CCS-750XPM-48NH-LC, CCS-750XPM-48TXH-LC)"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.2F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.1M",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(config-if-Et3/1)#show active all | grep speed\n no speed\n\nswitch(config-if-Et3/2)#show active\ninterface Ethernet3/2\n speed auto\u003c/pre\u003e"
}
],
"value": "switch(config-if-Et3/1)#show active all | grep speed\n no speed\n\nswitch(config-if-Et3/2)#show active\ninterface Ethernet3/2\n speed auto"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:10:00.972Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225"
}
],
"source": {
"advisory": "Security Advisory 0225",
"defects": [
"1880613"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0225",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(config)# interface Ethernet3/2\nswitch(config-if-Et3/2)# speed auto 1g\n\n(Workaround: configure an explicit speed on all interfaces to prevent exposure)\u003c/pre\u003e"
}
],
"value": "switch(config)# interface Ethernet3/2\nswitch(config-if-Et3/2)# speed auto 1g\n\n(Workaround: configure an explicit speed on all interfaces to prevent exposure)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121369",
"datePublished": "2026-11-10T20:10:00.972Z",
"dateReserved": "2026-11-03T11:27:14.150Z",
"dateUpdated": "2026-11-13T16:42:38.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121368 (GCVE-0-2026-121368)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:10 – Updated: 2026-11-13 17:25
VLAI
EPSS
VEX
Title
Security Advisory 0206
Summary
On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:25 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 1.0.0 , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:25:36.532360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:25:54.264Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode md5 shared-secret profile profile1\n\n(or meticulous mode, or sha1 variants)\n\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode md5 shared-secret profile profile1 meticulous\n\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode sha1 shared-secret profile profile1\n\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode sha1 shared-secret profile profile1 meticulous\n\n(Per-interface config may also apply:)\nswitch(s1)#show running-config section bfd\ninterface Ethernet1\n bfd authentication mode md5 shared-secret profile profile1\u003c/pre\u003e"
}
],
"value": "switch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode md5 shared-secret profile profile1\n\n(or meticulous mode, or sha1 variants)\n\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode md5 shared-secret profile profile1 meticulous\n\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode sha1 shared-secret profile profile1\n\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode sha1 shared-secret profile profile1 meticulous\n\n(Per-interface config may also apply:)\nswitch(s1)#show running-config section bfd\ninterface Ethernet1\n bfd authentication mode md5 shared-secret profile profile1"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "This issue was discovered externally by Joshua Foote from the XOR team at JP Morgan Chase \u0026 Co."
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 8.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:10:00.505Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206"
}
],
"source": {
"advisory": "Security Advisory 0206",
"defects": [
"1965007"
],
"discovery": "EXTERNAL"
},
"title": "Security Advisory 0206"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121368",
"datePublished": "2026-11-10T20:10:00.505Z",
"dateReserved": "2026-11-03T11:27:14.150Z",
"dateUpdated": "2026-11-13T17:25:54.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121367 (GCVE-0-2026-121367)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:10 – Updated: 2026-11-13 17:28
VLAI
EPSS
VEX
Title
Security Advisory 0220
Summary
On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication.
Successful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:28 UTC
CWE
- CWE-440 - Expected Behavior Violation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
1.0.0 , < 4.33.0F
(custom)
Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.36.0F , ≤ 4.36.2F (custom) Affected: 4.37.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121367",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:28:16.798719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:28:31.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.37.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch# show running-config section router rip\nrouter rip\n network 10.252.36.128/25\n no shutdown\n\nswitch# show running-config section interface Management1\ninterface Management1\n ip address 10.252.36.194/25\u003c/pre\u003e"
}
],
"value": "switch# show running-config section router rip\nrouter rip\n network 10.252.36.128/25\n no shutdown\n\nswitch# show running-config section interface Management1\ninterface Management1\n ip address 10.252.36.194/25"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device\u0027s management IP address. The device could accept and install those routes without authentication.\n\nSuccessful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-440",
"description": "CWE-440 Expected Behavior Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:10:00.035Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220"
}
],
"source": {
"advisory": "Security Advisory 0220",
"defects": [
"1981966"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0220",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch# configure terminal\nswitch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n\n(Workaround: In environments where RIP is not required, disable it within each affected VRF instance. If RIP is necessary on data interfaces but not the management subnet, verify no RIP network prefix matches the management subnet.)\u003c/pre\u003e"
}
],
"value": "switch# configure terminal\nswitch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n\n(Workaround: In environments where RIP is not required, disable it within each affected VRF instance. If RIP is necessary on data interfaces but not the management subnet, verify no RIP network prefix matches the management subnet.)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121367",
"datePublished": "2026-11-10T20:10:00.035Z",
"dateReserved": "2026-11-03T11:27:14.150Z",
"dateUpdated": "2026-11-13T17:28:31.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121295 (GCVE-0-2026-121295)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:29
VLAI
EPSS
VEX
Title
Security Advisory 0223
Summary
On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:29 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 1.0.0 , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:29:15.234942Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:29:29.183Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7280R/R2/R3/R4 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eCVE-2026-121294:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n reflector local-discriminator \u003cDISC\u003e proxy\n\nCVE-2026-121295:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n initiator measurement delay round-trip\u003c/pre\u003e"
}
],
"value": "CVE-2026-121294:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n reflector local-discriminator \u003cDISC\u003e proxy\n\nCVE-2026-121295:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n initiator measurement delay round-trip"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:59.572Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"
}
],
"source": {
"advisory": "Security Advisory 0223",
"defects": [
"1966375"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0223"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121295",
"datePublished": "2026-11-10T20:09:59.572Z",
"dateReserved": "2026-11-03T11:21:01.892Z",
"dateUpdated": "2026-11-13T17:29:29.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121294 (GCVE-0-2026-121294)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:30
VLAI
EPSS
VEX
Title
Security Advisory 0223
Summary
On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:30 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.29.0F , < 4.32.0F (custom) Affected: 4.28.2F , < 4.29.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:30:05.947981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:30:17.946Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7280R/R2/R3/R4 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.29.0F",
"versionType": "custom"
},
{
"lessThan": "4.29.0F",
"status": "affected",
"version": "4.28.2F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eCVE-2026-121294:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n reflector local-discriminator \u003cDISC\u003e proxy\n\nCVE-2026-121295:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n initiator measurement delay round-trip\u003c/pre\u003e"
}
],
"value": "CVE-2026-121294:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n reflector local-discriminator \u003cDISC\u003e proxy\n\nCVE-2026-121295:\nswitch#show running-config section sbfd\nrouter bfd\n sbfd\n initiator measurement delay round-trip"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:59.104Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"
}
],
"source": {
"advisory": "Security Advisory 0223",
"defects": [
"1964292"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0223"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121294",
"datePublished": "2026-11-10T20:09:59.104Z",
"dateReserved": "2026-11-03T11:21:01.892Z",
"dateUpdated": "2026-11-13T17:30:17.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121293 (GCVE-0-2026-121293)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:30
VLAI
EPSS
VEX
Title
Security Advisory 0210
Summary
On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:30 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
1.0.0 , < 4.33.0F
(custom)
Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.36.0F , ≤ 4.36.2F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:30:37.445774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:30:53.506Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eevpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc PfxAdv\n 12.0.0.3 4 300 44 43 0 0 00:14:55 Estab 1 1 1\nevpnsfe1#\u003c/pre\u003e"
}
],
"value": "evpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc PfxAdv\n 12.0.0.3 4 300 44 43 0 0 00:14:55 Estab 1 1 1\nevpnsfe1#"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:58.650Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210"
}
],
"source": {
"advisory": "Security Advisory 0210",
"defects": [
"1961865",
"1961866"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0210"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121293",
"datePublished": "2026-11-10T20:09:58.650Z",
"dateReserved": "2026-11-03T11:21:01.892Z",
"dateUpdated": "2026-11-13T17:30:53.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121292 (GCVE-0-2026-121292)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:31
VLAI
EPSS
VEX
Title
Security Advisory 0222
Summary
A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:31 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.37.0F
(custom)
Affected: 4.36.0F , ≤ 4.36.2F (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.24.0F , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:31:16.817205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:31:27.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "4.37.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.24.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003e show bgp rpki cache\n\nThe configuration should contain an RPKI cache entry under BGP:\n\nrouter bgp \u003cASN\u003e\n rpki cache \u003ccache-name\u003e\n host \u003ccache-address\u003e\u003c/pre\u003e"
}
],
"value": "switch\u003e show bgp rpki cache\n\nThe configuration should contain an RPKI cache entry under BGP:\n\nrouter bgp \u003cASN\u003e\n rpki cache \u003ccache-name\u003e\n host \u003ccache-address\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:L/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:58.193Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"
}
],
"source": {
"advisory": "Security Advisory 0222",
"defects": [
"1936846"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0222"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121292",
"datePublished": "2026-11-10T20:09:58.193Z",
"dateReserved": "2026-11-03T11:21:01.892Z",
"dateUpdated": "2026-11-13T17:31:27.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121291 (GCVE-0-2026-121291)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:27
VLAI
EPSS
VEX
Title
Security Advisory 0222
Summary
A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:27 UTC
CWE
- CWE-696 - Incorrect Behavior Order
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.37.0F
(custom)
Affected: 4.36.0F , ≤ 4.36.2F (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:27:27.385133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:27:40.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "4.37.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003e show bgp rpki cache\n\nThe configuration should contain an RPKI cache entry under BGP:\n\nrouter bgp \u003cASN\u003e\n rpki cache \u003ccache-name\u003e\n host \u003ccache-address\u003e\u003c/pre\u003e"
}
],
"value": "switch\u003e show bgp rpki cache\n\nThe configuration should contain an RPKI cache entry under BGP:\n\nrouter bgp \u003cASN\u003e\n rpki cache \u003ccache-name\u003e\n host \u003ccache-address\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-696",
"description": "CWE-696 Incorrect Behavior Order",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:57.730Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"
}
],
"source": {
"advisory": "Security Advisory 0222",
"defects": [
"1936844"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0222"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121291",
"datePublished": "2026-11-10T20:09:57.730Z",
"dateReserved": "2026-11-03T11:21:01.892Z",
"dateUpdated": "2026-11-13T17:27:40.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121290 (GCVE-0-2026-121290)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:33
VLAI
EPSS
VEX
Title
Security Advisory 0209
Summary
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:32 UTC
CWE
- CWE-420 - Unprotected Alternate Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 1.0.0 , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:32:45.993447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:33:02.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003eshow running-config section bgp | include listen-port\n bgp transport listen-port 1179\n\nswitch\u003eshow running-config all | inc service routing protocols\nservice routing protocols model multi-agent\u003c/pre\u003e"
}
],
"value": "switch\u003eshow running-config section bgp | include listen-port\n bgp transport listen-port 1179\n\nswitch\u003eshow running-config all | inc service routing protocols\nservice routing protocols model multi-agent"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-420",
"description": "CWE-420 Unprotected Alternate Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:57.273Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25031-security-advisory-0209"
}
],
"source": {
"advisory": "Security Advisory 0209",
"defects": [
"1977472"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0209",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003erouter bgp \u003casn\u003e\n no bgp transport listen-port\n\nIf the non-default listen port must be retained, the required modifications to the control plane ACL (to allow the non-default listen port to be reached) should be made in such a manner to provide the desired protection \u2014 only allowing TCP connections using the non-default listen port when the remote IP address is an expected one, and if applicable, when the TTL value is within the expected range.\u003c/pre\u003e"
}
],
"value": "router bgp \u003casn\u003e\n no bgp transport listen-port\n\nIf the non-default listen port must be retained, the required modifications to the control plane ACL (to allow the non-default listen port to be reached) should be made in such a manner to provide the desired protection \u2014 only allowing TCP connections using the non-default listen port when the remote IP address is an expected one, and if applicable, when the TTL value is within the expected range."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121290",
"datePublished": "2026-11-10T20:09:57.273Z",
"dateReserved": "2026-11-03T11:21:01.892Z",
"dateUpdated": "2026-11-13T17:33:02.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121289 (GCVE-0-2026-121289)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:33
VLAI
EPSS
VEX
Title
Security Advisory 0208
Summary
On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.
Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:33 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.25.1F , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:33:36.524401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:33:50.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.25.1F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003eshow ip bgp summary\nBGP summary information for VRF default\nRouter identifier 10.0.0.1, local AS number 65000\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\n 10.0.0.2 4 65001 100 100 0 0 01:00:00 Estab 10 10\n\nswitch\u003eshow running-config all | inc service routing protocols\nservice routing protocols model multi-agent\u003c/pre\u003e"
}
],
"value": "switch\u003eshow ip bgp summary\nBGP summary information for VRF default\nRouter identifier 10.0.0.1, local AS number 65000\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\n 10.0.0.2 4 65001 100 100 0 0 01:00:00 Estab 10 10\n\nswitch\u003eshow running-config all | inc service routing protocols\nservice routing protocols model multi-agent"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "This issue was reported to Arista by Joshua Foote of JP Morgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.\n\nSuccessful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:56.814Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208"
}
],
"source": {
"advisory": "Security Advisory 0208",
"defects": [
"1927959"
],
"discovery": "EXTERNAL"
},
"title": "Security Advisory 0208",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eFor BGP sessions that do not rely on the Tunnel Encapsulation Attribute, a workaround is to remove all received Tunnel Encapsulation Attributes by configuring attribute discard, for example:\n\nneighbor default received attribute discard 23\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using TCP-AO in order to ensure that only authorized peers can establish a BGP session.\u003c/pre\u003e"
}
],
"value": "For BGP sessions that do not rely on the Tunnel Encapsulation Attribute, a workaround is to remove all received Tunnel Encapsulation Attributes by configuring attribute discard, for example:\n\nneighbor default received attribute discard 23\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using TCP-AO in order to ensure that only authorized peers can establish a BGP session."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121289",
"datePublished": "2026-11-10T20:09:56.814Z",
"dateReserved": "2026-11-03T11:21:01.892Z",
"dateUpdated": "2026-11-13T17:33:50.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121288 (GCVE-0-2026-121288)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:34
VLAI
EPSS
VEX
Title
Security Advisory 0221
Summary
An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:34 UTC
CWE
- CWE-303 - Incorrect Implementation of Authentication Algorithm
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.37.0F
(custom)
Affected: 4.36.0F , ≤ 4.36.2F (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 1.0.0 , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:34:24.792520Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:34:37.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "4.37.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch# show running-config | section router rip\nrouter rip\n no shutdown\n network 192.0.2.0/24\n\nswitch# show running-config interfaces Ethernet1\ninterface Ethernet1\n ip address 192.0.2.1/24 \n rip authentication algorithm md5 tx key-id 10\u003c/pre\u003e"
}
],
"value": "switch# show running-config | section router rip\nrouter rip\n no shutdown\n network 192.0.2.0/24\n\nswitch# show running-config interfaces Ethernet1\ninterface Ethernet1\n ip address 192.0.2.1/24 \n rip authentication algorithm md5 tx key-id 10"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Arista would like to acknowledge and thank Joshua Foote from the XOR team at JP Morgan Chase for responsibly reporting CVE-2026-121288."
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303 Incorrect Implementation of Authentication Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:56.336Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"
}
],
"source": {
"advisory": "Security Advisory 0221",
"defects": [
"1985547"
],
"discovery": "EXTERNAL"
},
"title": "Security Advisory 0221",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n\nNote: disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior.\u003c/pre\u003e"
}
],
"value": "switch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n\nNote: disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121288",
"datePublished": "2026-11-10T20:09:56.336Z",
"dateReserved": "2026-11-03T11:21:01.891Z",
"dateUpdated": "2026-11-13T17:34:37.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121287 (GCVE-0-2026-121287)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 13:53
VLAI
EPSS
VEX
Title
Security Advisory 0221
Summary
An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 05:00 UTC
CWE
- CWE-124 - Buffer Underwrite ('Buffer Underflow')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.37.0F
(custom)
Affected: 4.36.0F , ≤ 4.36.2F (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 1.0.0 , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121287",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T05:00:12.976294Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T13:53:02.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "4.37.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch# show running-config | section router rip\nrouter rip\n no shutdown\n network 192.0.2.0/24\n\nswitch# show running-config interfaces Ethernet1\ninterface Ethernet1\n ip address 192.0.2.1/24 \n rip authentication algorithm md5 tx key-id 10\u003c/pre\u003e"
}
],
"value": "switch# show running-config | section router rip\nrouter rip\n no shutdown\n network 192.0.2.0/24\n\nswitch# show running-config interfaces Ethernet1\ninterface Ethernet1\n ip address 192.0.2.1/24 \n rip authentication algorithm md5 tx key-id 10"
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-124",
"description": "CWE-124 Buffer Underwrite (\u0027Buffer Underflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:55.863Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"
}
],
"source": {
"advisory": "Security Advisory 0221",
"defects": [
"1981970"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0221",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n\nNote: disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior.\u003c/pre\u003e"
}
],
"value": "switch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n\nNote: disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121287",
"datePublished": "2026-11-10T20:09:55.863Z",
"dateReserved": "2026-11-03T11:21:01.891Z",
"dateUpdated": "2026-11-13T13:53:02.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121286 (GCVE-0-2026-121286)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:35
VLAI
EPSS
VEX
Title
Security Advisory 0213
Summary
On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:35 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.22.1F , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:35:26.850369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:35:38.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.22.1F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch# show ip route summary\n...\nOperating routing protocol model: multi-agent\nConfigured routing protocol model: multi-agent\n...\n\nswitch# show bgp sr-te summary\nBGP summary information for VRF default\nRouter identifier 192.0.2.2, local AS number 100\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\n 192.0.2.1 4 100 407 413 0 0 00:18:57 Estab 1 1\n 2001:DB8::1 4 100 407 413 0 0 00:18:57 Estab 1 1\u003c/pre\u003e"
}
],
"value": "switch# show ip route summary\n...\nOperating routing protocol model: multi-agent\nConfigured routing protocol model: multi-agent\n...\n\nswitch# show bgp sr-te summary\nBGP summary information for VRF default\nRouter identifier 192.0.2.2, local AS number 100\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\n 192.0.2.1 4 100 407 413 0 0 00:18:57 Estab 1 1\n 2001:DB8::1 4 100 407 413 0 0 00:18:57 Estab 1 1"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:55.398Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25035-security-advisory-0213"
}
],
"source": {
"advisory": "Security Advisory 0213",
"defects": [
"1975990"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0213",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eFor complete mitigation guidance and assistance, customers are advised to contact the Arista Networks Technical Assistance Center (TAC) for support.\u003c/pre\u003e"
}
],
"value": "For complete mitigation guidance and assistance, customers are advised to contact the Arista Networks Technical Assistance Center (TAC) for support."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-121286",
"datePublished": "2026-11-10T20:09:55.398Z",
"dateReserved": "2026-11-03T11:21:01.891Z",
"dateUpdated": "2026-11-13T17:35:38.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120983 (GCVE-0-2026-120983)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:36
VLAI
EPSS
VEX
Title
Security Advisory 0215
Summary
On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:35 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
1.0.0 , < 4.33.0F
(custom)
Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.1F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120983",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:35:59.580472Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:36:22.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"7010TX Series",
"7320X Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7300X/X3 Series",
"7050X3/X4 Series",
"750X Series",
"7250 Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003econfig#interface Ethernet21/1\nconfig-if-Et21/1#show active\ninterface Ethernet21/1\n speed forced 100gfull\n switchport access vlan 2\n dot1x pae authenticator\n dot1x port-control auto\n dot1x host-mode multi-host authenticated\n\nswitch# show policy-map type pbr\nService policy PermitAnyPolicy\n Configured on: Vlan2\n Applied on: Vlan2\n 10: Class-map: PermitAnyClass (match-any)\n Match: 10 IP Access List PermitAnyAcl\n counters per-entry\n 10 permit ip any any\n\n Configured actions: set nexthop 30.1.1.2\n Active routing action:\n VRF default\n Route to nexthop 30.1.1.2 default\u003c/pre\u003e"
}
],
"value": "config#interface Ethernet21/1\nconfig-if-Et21/1#show active\ninterface Ethernet21/1\n speed forced 100gfull\n switchport access vlan 2\n dot1x pae authenticator\n dot1x port-control auto\n dot1x host-mode multi-host authenticated\n\nswitch# show policy-map type pbr\nService policy PermitAnyPolicy\n Configured on: Vlan2\n Applied on: Vlan2\n 10: Class-map: PermitAnyClass (match-any)\n Match: 10 IP Access List PermitAnyAcl\n counters per-entry\n 10 permit ip any any\n\n Configured actions: set nexthop 30.1.1.2\n Active routing action:\n VRF default\n Route to nexthop 30.1.1.2 default"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:54.948Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25037-security-advisory-0215"
}
],
"source": {
"advisory": "Security Advisory 0215",
"defects": [
"903925"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0215",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eip access-list PermitAnyAcl\n counters per-entry\n 10 permit ip 20.1.1.0/24 any\n\n(Workaround: Configure the PBR policy with specific, trusted address ranges rather than broad match rules)\u003c/pre\u003e"
}
],
"value": "ip access-list PermitAnyAcl\n counters per-entry\n 10 permit ip 20.1.1.0/24 any\n\n(Workaround: Configure the PBR policy with specific, trusted address ranges rather than broad match rules)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120983",
"datePublished": "2026-11-10T20:09:54.948Z",
"dateReserved": "2026-11-03T05:14:06.128Z",
"dateUpdated": "2026-11-13T17:36:22.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120982 (GCVE-0-2026-120982)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:37
VLAI
EPSS
VEX
Title
Security Advisory 0207
Summary
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:37 UTC
CWE
- CWE-440 - Expected Behavior Violation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 1.0.0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:37:26.523551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:37:51.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003eshow ip bgp summary\nBGP router identifier X.X.X.X, local AS number XXXXX\n...\nNeighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\nX.X.X.X 4 XXXXX 100 100 0 0 01:00:00 Estab 10 10\n\nswitch\u003eshow running-config all | inc service routing protocols\nservice routing protocols model multi-agent\u003c/pre\u003e"
}
],
"value": "switch\u003eshow ip bgp summary\nBGP router identifier X.X.X.X, local AS number XXXXX\n...\nNeighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\nX.X.X.X 4 XXXXX 100 100 0 0 01:00:00 Estab 10 10\n\nswitch\u003eshow running-config all | inc service routing protocols\nservice routing protocols model multi-agent"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding."
}
],
"impacts": [
{
"capecId": "CAPEC-230",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-230 Serialized Data with Nested Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-440",
"description": "CWE-440 Expected Behavior Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:54.489Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25029-security-advisory-0207"
}
],
"source": {
"advisory": "Security Advisory 0207",
"defects": [
"1927714"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0207",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003erouter bgp \u003casn\u003e\n neighbor default received attribute discard 22\n\nThe above configuration applies the mitigation globally. The attribute can be re-enabled on specific peers if it is required within the customer application. For example:\n\nrouter bgp \u003casn\u003e\n no neighbor X.X.X.X received attribute discard 22\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using TCP-AO in order to ensure that only authorized peers can establish a BGP session.\u003c/pre\u003e"
}
],
"value": "router bgp \u003casn\u003e\n neighbor default received attribute discard 22\n\nThe above configuration applies the mitigation globally. The attribute can be re-enabled on specific peers if it is required within the customer application. For example:\n\nrouter bgp \u003casn\u003e\n no neighbor X.X.X.X received attribute discard 22\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using TCP-AO in order to ensure that only authorized peers can establish a BGP session."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120982",
"datePublished": "2026-11-10T20:09:54.489Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-13T17:37:51.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120981 (GCVE-0-2026-120981)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 17:32
VLAI
EPSS
VEX
Title
Security Advisory 0214
Summary
On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:32 UTC
CWE
- CWE-772 - Missing Release of Resource after Effective Lifetime
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.33.0F , ≤ 4.33.10M
(custom)
Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.36.0F , ≤ 4.36.2F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:32:00.464058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:32:12.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"7280R3 Series",
"7500R3 Series",
"7800R3 Series"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003eshow bgp vpls signaling \nVPLS instance: CUSTOMER_1, group: BGP_MESH_1\nRoute distinguisher: 10.1.1.1:42\nRoute target to import: Route-Target-AS:65534:100\nRoute target to export: Route-Target-AS:65534:100\nLocal VE-ID: 1\nRemote VE-ID: 2, address: 10.2.2.2, encap label: 116384, decap label: 136385\nRemote VE-ID: 3, address: 10.3.3.3, encap label: 116385, decap label: 136386\u003c/pre\u003e"
}
],
"value": "switch\u003eshow bgp vpls signaling \nVPLS instance: CUSTOMER_1, group: BGP_MESH_1\nRoute distinguisher: 10.1.1.1:42\nRoute target to import: Route-Target-AS:65534:100\nRoute target to export: Route-Target-AS:65534:100\nLocal VE-ID: 1\nRemote VE-ID: 2, address: 10.2.2.2, encap label: 116384, decap label: 136385\nRemote VE-ID: 3, address: 10.3.3.3, encap label: 116385, decap label: 136386"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:54.017Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"
}
],
"source": {
"advisory": "Security Advisory 0214",
"defects": [
"1925302"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0214"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120981",
"datePublished": "2026-11-10T20:09:54.017Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-13T17:32:12.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120980 (GCVE-0-2026-120980)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-10 20:09
VLAI
EPSS
VEX
Title
Security Advisory 0214
Summary
On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly.
Severity
CWE
- CWE-617 - Reachable Assertion
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.33.0F , ≤ 4.33.10M
(custom)
Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.36.0F , ≤ 4.36.2F (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"7280R3 Series",
"7500R3 Series",
"7800R3 Series"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003eshow bgp vpls signaling \nVPLS instance: CUSTOMER_1, group: BGP_MESH_1\nRoute distinguisher: 10.1.1.1:42\nRoute target to import: Route-Target-AS:65534:100\nRoute target to export: Route-Target-AS:65534:100\nLocal VE-ID: 1\nRemote VE-ID: 2, address: 10.2.2.2, encap label: 116384, decap label: 136385\nRemote VE-ID: 3, address: 10.3.3.3, encap label: 116385, decap label: 136386\u003c/pre\u003e"
}
],
"value": "switch\u003eshow bgp vpls signaling \nVPLS instance: CUSTOMER_1, group: BGP_MESH_1\nRoute distinguisher: 10.1.1.1:42\nRoute target to import: Route-Target-AS:65534:100\nRoute target to export: Route-Target-AS:65534:100\nLocal VE-ID: 1\nRemote VE-ID: 2, address: 10.2.2.2, encap label: 116384, decap label: 136385\nRemote VE-ID: 3, address: 10.3.3.3, encap label: 116385, decap label: 136386"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly."
}
],
"impacts": [
{
"capecId": "CAPEC-230",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-230 Serialized Data with Nested Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617 Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:53.555Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"
}
],
"source": {
"advisory": "Security Advisory 0214",
"defects": [
"1925240"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0214"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120980",
"datePublished": "2026-11-10T20:09:53.555Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-10T20:09:53.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120979 (GCVE-0-2026-120979)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-10 20:09
VLAI
EPSS
VEX
Title
Security Advisory 0212
Summary
This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding.
Severity
CWE
- CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.2F
(custom)
Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 1.0.0 , < 4.32.0F (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(config)#show bgp link-state summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State NlriRcd NlriAcc NlriAdv\n 12.0.0.3 4 300 82 83 0 0 01:02:33 Estab 0 0 1\n\nswitch#show adaptive-virtual-topology path | section Role:\nRole: pathfinder\u003c/pre\u003e"
}
],
"value": "switch(config)#show bgp link-state summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State NlriRcd NlriAcc NlriAdv\n 12.0.0.3 4 300 82 83 0 0 01:02:33 Estab 0 0 1\n\nswitch#show adaptive-virtual-topology path | section Role:\nRole: pathfinder"
}
],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding."
}
],
"impacts": [
{
"capecId": "CAPEC-194",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-194 Fake the Source of Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1289",
"description": "CWE-1289 Improper Validation of Unsafe Equivalence in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:53.082Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212"
}
],
"source": {
"advisory": "Security Advisory 0212",
"defects": [
"2059581"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0212"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120979",
"datePublished": "2026-11-10T20:09:53.082Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-10T20:09:53.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120978 (GCVE-0-2026-120978)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-10 20:09
VLAI
EPSS
VEX
Title
Security Advisory 0211
Summary
On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required.
Severity
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
1.0.0 , < 4.33.0F
(custom)
Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.10M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.36.0F , ≤ 4.36.2F (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.10M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch(config)#show bgp link-state summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State NlriRcd NlriAcc NlriAdv\n 12.0.0.3 4 300 82 83 0 0 01:02:33 Estab 0 0 1\nswitch(config)#\n\nswitch#show bgp instance | section Address family Link State:\nAddress family Link State:\n Role(s): Consumer (DPS)\u003c/pre\u003e"
}
],
"value": "switch(config)#show bgp link-state summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State NlriRcd NlriAcc NlriAdv\n 12.0.0.3 4 300 82 83 0 0 01:02:33 Estab 0 0 1\nswitch(config)#\n\nswitch#show bgp instance | section Address family Link State:\nAddress family Link State:\n Role(s): Consumer (DPS)"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:52.613Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25033-security-advisory-0211"
}
],
"source": {
"advisory": "Security Advisory 0211",
"defects": [
"1924022"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0211"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120978",
"datePublished": "2026-11-10T20:09:52.613Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-10T20:09:52.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120977 (GCVE-0-2026-120977)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-13 13:53
VLAI
EPSS
VEX
Title
Security Advisory 0217
Summary
On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 05:00 UTC
CWE
- CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.31.2F , < 4.32.0F
(custom)
Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.2F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120977",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T05:00:16.425048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T13:53:31.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7700R4 Series",
"7800R3/R4 Series"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.2F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch#show running-config\naaa accounting dot1x default start-stop group radius\n\ndot1x\n ! Any one of the following DHCP profiling options is sufficient;\n ! enabling all three is not required.\n radius av-pair dhcp hostname\n radius av-pair dhcp parameter-request-list\n radius av-pair dhcp vendor-class-id\n\ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\ndot1x system-auth-control\u003c/pre\u003e"
}
],
"value": "switch#show running-config\naaa accounting dot1x default start-stop group radius\n\ndot1x\n ! Any one of the following DHCP profiling options is sufficient;\n ! enabling all three is not required.\n radius av-pair dhcp hostname\n radius av-pair dhcp parameter-request-list\n radius av-pair dhcp vendor-class-id\n\ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\ndot1x system-auth-control"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges."
}
],
"impacts": [
{
"capecId": "CAPEC-194",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-194 Fake the Source of Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807 Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:52.143Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217"
}
],
"source": {
"advisory": "Security Advisory 0217",
"defects": [
"1899366"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0217"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120977",
"datePublished": "2026-11-10T20:09:52.143Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-13T13:53:31.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120976 (GCVE-0-2026-120976)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-10 20:09
VLAI
EPSS
VEX
Title
Security Advisory 0216
Summary
On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).
An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.
The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.
Severity
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.22.0F , < 4.32.0F
(custom)
Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 4.34.0F , ≤ 4.34.8M (custom) Affected: 4.35.0F , ≤ 4.35.6M (custom) Affected: 4.36.0F , ≤ 4.36.2F (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"7388-8D Series",
"7500R/R2 Series",
"7800/R3/R3A Series",
"722XPM and 720XPM Series",
"750X Series",
"7050X3/X4 Series",
"7170 Series",
"7289R3 Series",
"7500R3 Series",
"7800R4 Series"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.22.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.8M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.6M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.2F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch#show running-config section dot1x\ndot1x system-auth-control\n!\ninterface Ethernet1\n dot1x pae authenticator\n dot1x port-control auto\n\nswitch#show running-config section mac security\nmac security\n profile macsecDot1xProfile\n key source dot1x\n!\ninterface Ethernet1\n mac security profile macsecDot1xProfile\u003c/pre\u003e"
}
],
"value": "switch#show running-config section dot1x\ndot1x system-auth-control\n!\ninterface Ethernet1\n dot1x pae authenticator\n dot1x port-control auto\n\nswitch#show running-config section mac security\nmac security\n profile macsecDot1xProfile\n key source dot1x\n!\ninterface Ethernet1\n mac security profile macsecDot1xProfile"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).\n\nAn attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.\n\nThe vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:51.694Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25038-security-advisory-0216"
}
],
"source": {
"advisory": "Security Advisory 0216",
"defects": [
"1899357"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0216"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120976",
"datePublished": "2026-11-10T20:09:51.694Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-10T20:09:51.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120975 (GCVE-0-2026-120975)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-10 20:09
VLAI
EPSS
VEX
Title
Security Advisory 0205
Summary
On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services.
Severity
CWE
- CWE-197 - Numeric Truncation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.1F , ≤ 4.36.1F
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.1F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e#show running-config section auto-certificate\nmanagement security\n auto-certificate profile cert1\n key clientkey.pem\n parameters distinguished-name common-name \"arista\"\n protocol instance est1\n auto-certificate protocol est est1\n server url https://example.com\n server ca-certificate auto-update\n server ca-certificate validation fingerprint sha2-256 \u003c...\u003e\u003c/pre\u003e"
}
],
"value": "#show running-config section auto-certificate\nmanagement security\n auto-certificate profile cert1\n key clientkey.pem\n parameters distinguished-name common-name \"arista\"\n protocol instance est1\n auto-certificate protocol est est1\n server url https://example.com\n server ca-certificate auto-update\n server ca-certificate validation fingerprint sha2-256 \u003c...\u003e"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services."
}
],
"impacts": [
{
"capecId": "CAPEC-22",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-22 Exploiting Trust in Client"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-197",
"description": "CWE-197 Numeric Truncation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:51.213Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25027-security-advisory-0205"
}
],
"source": {
"advisory": "Security Advisory 0205",
"defects": [
"2047420"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0205",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e(config-mgmt-sec-auto-cert-proto-est-est1)# no server ca-certificate auto-update\n(config-mgmt-sec-auto-cert-proto-est-est1)# server url https://example.com\n(config-mgmt-sec-auto-cert-proto-est-est1)# server ssl profile ssl1\n\n(Workaround: Disable automatic CA certificate retrieval and use manually distributed CA certificates under an SSL profile)\u003c/pre\u003e"
}
],
"value": "(config-mgmt-sec-auto-cert-proto-est-est1)# no server ca-certificate auto-update\n(config-mgmt-sec-auto-cert-proto-est-est1)# server url https://example.com\n(config-mgmt-sec-auto-cert-proto-est-est1)# server ssl profile ssl1\n\n(Workaround: Disable automatic CA certificate retrieval and use manually distributed CA certificates under an SSL profile)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120975",
"datePublished": "2026-11-10T20:09:51.213Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-10T20:09:51.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120974 (GCVE-0-2026-120974)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-10 20:09
VLAI
EPSS
VEX
Title
Security Advisory 0219
Summary
On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.
Severity
5.3 (Medium)
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.27.0F , < 4.28.0F
(custom)
Affected: 4.28.0F , ≤ 4.28.13M (custom) Affected: 4.29.0F , < 4.30.0F (custom) Affected: 4.30.0F , < 4.31.0F (custom) Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.1F (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.28.0F",
"status": "affected",
"version": "4.27.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.28.13M",
"status": "affected",
"version": "4.28.0F",
"versionType": "custom"
},
{
"lessThan": "4.30.0F",
"status": "affected",
"version": "4.29.0F",
"versionType": "custom"
},
{
"lessThan": "4.31.0F",
"status": "affected",
"version": "4.30.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eswitch\u003e show running-config all section key controller\nip security\n key controller\n profile dp\n dh-group 16\n lifetime 1 hours\n\nswitch\u003e show running-config all section anti-replay\nip security\n sa policy dynamic-sa\n anti-replay detection\n\nswitch\u003e show ip security key controller local\nDH group: 16\nCrypto suite: 128-bit AES , 256bit Hash\nInitial DH key created: 22 hours, 46 minutes, 43 seconds\nLast DH key created: 9 hours, 29 minutes, 40 seconds\nDH rekey: N/A\u003c/pre\u003e"
}
],
"value": "switch\u003e show running-config all section key controller\nip security\n key controller\n profile dp\n dh-group 16\n lifetime 1 hours\n\nswitch\u003e show running-config all section anti-replay\nip security\n sa policy dynamic-sa\n anti-replay detection\n\nswitch\u003e show ip security key controller local\nDH group: 16\nCrypto suite: 128-bit AES , 256bit Hash\nInitial DH key created: 22 hours, 46 minutes, 43 seconds\nLast DH key created: 9 hours, 29 minutes, 40 seconds\nDH rekey: N/A"
}
],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator\u0027s expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:50.760Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219"
}
],
"source": {
"advisory": "Security Advisory 0219",
"defects": [
"1570728"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0219"
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-120974",
"datePublished": "2026-11-10T20:09:50.760Z",
"dateReserved": "2026-11-03T05:14:06.127Z",
"dateUpdated": "2026-11-10T20:09:50.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102166 (GCVE-0-2026-102166)
Vulnerability from cvelistv5 – Published: 2026-11-10 20:09 – Updated: 2026-11-10 20:09
VLAI
EPSS
VEX
Title
Security Advisory 0227
Summary
Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.
Severity
8.8 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Point |
Affected:
1.0.0 , < *
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Wi-Fi Access Points C-260",
"Wi-Fi Access Points C-250"
],
"product": "Wi-Fi Access Point",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eNo specific configuration required. Vulnerability is specific to C-260 and C-250 access point hardware models.\u003c/pre\u003e"
}
],
"value": "No specific configuration required. Vulnerability is specific to C-260 and C-250 access point hardware models."
}
],
"descriptions": [
{
"lang": "en",
"value": "Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191 Read Sensitive Constants Within an Executable"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T20:09:50.306Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227"
}
],
"source": {
"advisory": "Security Advisory 0227",
"defects": [
"1846906"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0227",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003enerdctl exec -it wifimanager -- bash\n\n[root@wifi-security-server1 /]# su - config\n\n[config]$ set config parameter\nEnter parameter name: upgrade_hmac_fallback_enabled\nEnter parameter value: 0\nEnter configid: 3\n(confirm: y)\n\n[config]$ set config parameter\nEnter parameter name: upgrade_hmac_fallback_enabled\nEnter parameter value: 0\nEnter configid: 1\n(confirm: y)\n\n[root@wifi-security-server1 /]# /etc/init.d/sserverd restart\n\n(Workaround: Disable the HMAC-based firmware verification fallback path. For cloud deployments, contact Arista TAC.)\u003c/pre\u003e"
}
],
"value": "nerdctl exec -it wifimanager -- bash\n\n[root@wifi-security-server1 /]# su - config\n\n[config]$ set config parameter\nEnter parameter name: upgrade_hmac_fallback_enabled\nEnter parameter value: 0\nEnter configid: 3\n(confirm: y)\n\n[config]$ set config parameter\nEnter parameter name: upgrade_hmac_fallback_enabled\nEnter parameter value: 0\nEnter configid: 1\n(confirm: y)\n\n[root@wifi-security-server1 /]# /etc/init.d/sserverd restart\n\n(Workaround: Disable the HMAC-based firmware verification fallback path. For cloud deployments, contact Arista TAC.)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102166",
"datePublished": "2026-11-10T20:09:50.306Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-11-10T20:09:50.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114625 (GCVE-0-2026-114625)
Vulnerability from cvelistv5 – Published: 2026-10-22 20:47 – Updated: 2026-10-24 03:55Title
Security Advisory 0199
Summary
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Severity
9.9 (Critical)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 00:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator |
Affected:
5.2.0 , < 5.2.3.18
(custom)
Affected: 6.1.0 , < 6.1.3.10 (custom) Affected: 6.4.0 , < 6.4.2.12 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114625",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-10-23",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T03:55:14.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T00:00:00.000Z",
"value": "CVE-2026-114625 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"VeloCloud Orchestrator On-Prem"
],
"product": "VeloCloud Orchestrator",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.3.18",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "6.1.3.10",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.12",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVCO is exposed by default. A successful attack requires network access to the VCO web interface and a valid authenticated session on the VCO portal. The minimum user role required is \u003cstrong\u003eEnterprise Read Only\u003c/strong\u003e, the lowest built-in tenant role. There is no configuration that can prevent the exposure.\u003c/p\u003e"
}
],
"value": "VCO is exposed by default. A successful attack requires network access to the VCO web interface and a valid authenticated session on the VCO portal. The minimum user role required is Enterprise Read Only, the lowest built-in tenant role. There is no configuration that can prevent the exposure."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\u003c/p\u003e\u003cp\u003eOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \u0026quot;superuser operator\u0026quot; user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.\u003c/p\u003e\u003cp\u003eHosted, including Dedicated, versions of VCO were impacted and have already been patched.\u003c/p\u003e"
}
],
"value": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nOn an affected system, any authenticated user can gain operator privileges and masquerade as a local \"superuser operator\" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T20:47:56.427Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0199",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\u003c/p\u003e\u003cp\u003eThese vulnerabilities have been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003eVCO \u003cstrong\u003e5.2.3.18\u003c/strong\u003e and later in the 5.2 train\u003c/li\u003e\u003cli\u003eVCO \u003cstrong\u003e6.1.3.10\u003c/strong\u003e and later in the 6.1 train\u003c/li\u003e\u003cli\u003eVCO \u003cstrong\u003e6.4.2.12\u003c/strong\u003e and later in the 6.4 train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThese vulnerabilities have been fixed in the following releases:\n\n- VCO 5.2.3.18 and later in the 5.2 train\n- VCO 6.1.3.10 and later in the 6.1 train\n- VCO 6.4.2.12 and later in the 6.4 train"
}
],
"source": {
"advisory": "Security Advisory 0199",
"defects": [
"BUG2043622"
],
"discovery": "EXTERNAL"
},
"title": "Security Advisory 0199",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\u003c/p\u003e\u003cul\u003e\u003cli\u003eRestrict access to the VCO web interface to trusted administrative networks.\u003c/li\u003e\u003cli\u003eMonitor the VCO for accesses from known malicious source IPs.\u003c/li\u003e\u003cli\u003eMonitor for unexpected outbound network activity from the VCO host.\u003c/li\u003e\u003cli\u003eConsider blocking outbound ports not needed for normal activities.\u003c/li\u003e\u003cli\u003eMonitor for backdoor daemons and webshells.\u003c/li\u003e\u003cli\u003eReview recent administrator activity for unexpected changes.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n- Restrict access to the VCO web interface to trusted administrative networks.\n- Monitor the VCO for accesses from known malicious source IPs.\n- Monitor for unexpected outbound network activity from the VCO host.\n- Consider blocking outbound ports not needed for normal activities.\n- Monitor for backdoor daemons and webshells.\n- Review recent administrator activity for unexpected changes."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-114625",
"datePublished": "2026-10-22T20:47:56.427Z",
"dateReserved": "2026-10-21T20:35:35.535Z",
"dateUpdated": "2026-10-24T03:55:14.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102165 (GCVE-0-2026-102165)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:00
VLAI
EPSS
VEX
Title
Security Advisory 0198
Summary
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:59 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102165",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:59:55.213686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:00:05.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability.\u003c/p\u003e"
}
],
"value": "A Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:32.909Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102165 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102165 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0198",
"defects": [
"BUG 1846910"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0198",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\".\u003c/p\u003e"
}
],
"value": "When using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\"."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102165",
"datePublished": "2026-10-06T19:40:32.909Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:00:05.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102167 (GCVE-0-2026-102167)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:00
VLAI
EPSS
VEX
Title
Security Advisory 0197
Summary
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:00 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:00:24.458435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:00:36.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point\u0027s wired uplink network.\u003c/p\u003e"
}
],
"value": "No specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point\u0027s wired uplink network."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point\u0027s wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point\u0027s wired uplink.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point\u0027s wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point\u0027s wired uplink."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:32.432Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102167 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102167 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0197",
"defects": [
"BUG 1846909"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0197",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102167",
"datePublished": "2026-10-06T19:40:32.432Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-10-06T20:00:36.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102164 (GCVE-0-2026-102164)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:07
VLAI
EPSS
VEX
Title
Security Advisory 0196
Summary
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:07 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:07:46.593021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:07:54.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVXLAN tunnelling with L2-proxy must be enabled. This is a non-default configuration. If L2-proxy is not configured, the access point is not exposed to this vulnerability. The issue can be triggered either from the LAN or by an associated client.\u003c/p\u003e"
}
],
"value": "VXLAN tunnelling with L2-proxy must be enabled. This is a non-default configuration. If L2-proxy is not configured, the access point is not exposed to this vulnerability. The issue can be triggered either from the LAN or by an associated client."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.\u003c/p\u003e"
}
],
"value": "On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:31.913Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24812-security-advisory-0196"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102164 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102164 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0196",
"defects": [
"BUG 1774082"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0196",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf VXLAN tunnelling with L2-proxy is not required, disabling this configuration eliminates exposure.\u003c/p\u003e"
}
],
"value": "If VXLAN tunnelling with L2-proxy is not required, disabling this configuration eliminates exposure."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102164",
"datePublished": "2026-10-06T19:40:31.913Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:07:54.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}