{"id":"CVE-2026-120975","kind":"vulnerability","aliases":["CVE-2026-120975"],"related":[],"title":"Arista EOS: malicious packet can stop automatic certificate renewal","description":"On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services.","summary":"On Arista EOS switches with automatic certificate management and automatic CA certificate retrieval enabled, a malicious packet can crash the AutoCertMgmt process. Managed X.509 certificates then stop renewing and may expire, breaking TLS-dependent services.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Arista EOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["arista-eos","infrastructure","network-gear","tls-certificates"],"not_affected_if":["feature-disabled","manual-certificate-management"],"how_to_check":"- Check whether automatic certificate management (AutoCertMgmt) is configured and whether automatic CA certificate retrieval is enabled on the switch\n- Compare the running EOS version against the affected ranges in the Arista advisory: unknown","fix":null,"status":"open","published_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:49:23+00:00","updated_at":"2026-11-10T20:49:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T20:49:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: malicious packet can stop automatic certificate renewal","impact":"low","summary":"On Arista EOS switches with automatic certificate management and automatic CA certificate retrieval enabled, a malicious packet can crash the AutoCertMgmt process. Managed X.509 certificates then stop renewing and may expire, breaking TLS-dependent services.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","network-gear","tls-certificates"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"AutoCertMgmt process crashes, certificates expire without renewal","analyst_note":"Find the affected and fixed EOS versions and the vendor advisory in the Arista security advisories; the NVD entry alone does not list them.","how_to_check":"- Check whether automatic certificate management (AutoCertMgmt) is configured and whether automatic CA certificate retrieval is enabled on the switch\n- Compare the running EOS version against the affected ranges in the Arista advisory: unknown","plain_action":"","product_name":"Arista EOS","needs_analyst":true,"not_affected_if":["manual-certificate-management","feature-disabled"],"who_is_affected":"Only Arista EOS devices that run automatic certificate management with automatic CA certificate retrieval enabled are exposed. Switches that manage certificates manually, or that do not use this feature, can skip it. The sources do not list the exact affected EOS versions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000752,"input_tokens":4571,"output_tokens":590,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-120975':12A,15A '-2026':11A,14A 'affect':65C 'arista':1A,16A,19B,29B,68C 'arista-eo':18B 'author':78C 'autocertmgmt':48B,89C 'automat':7A,33B,37B,71C,76C,102C 'break':59B 'ca':38B,79C 'caus':87C 'certif':8A,27B,34B,39B,52B,72C,77C,80C,97C 'configur':74C 'crash':46B 'cve':10A,13A 'depend':62B,111C 'disrupt':108C 'enabl':41B,82C 'eo':2A,20B,30B,69C 'eos':17A 'eventu':105C 'expir':58B,106C 'gear':24B 'infrastructur':21B 'malici':3A,43B,84C 'manag':35B,50B,73C,95C 'may':57B,86C,104C 'network':23B 'network-gear':22B 'packet':4A,44B,85C 'platform':66C 'potenti':107C 'process':49B,90C 'renew':9A,55B,101C 'retriev':40B,81C 'run':67C 'servic':63B,112C 'stop':6A,54B 'switch':31B 'termin':93C 'tls':26B,61B,110C 'tls-certif':25B 'tls-depend':60B,109C 'unexpect':94C 'x.509':51B,96C","nicknames":[],"mitigations":[],"who_affected":"Only Arista EOS devices that run automatic certificate management with automatic CA certificate retrieval enabled are exposed. Switches that manage certificates manually, or that do not use this feature, can skip it. The sources do not list the exact affected EOS versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["aristaeos","eos"],"ptokens":["arista","eos"],"labels":["aristaeos","infrastructure","low","networkgear","tlscertificates","vendor"],"campaign_type":null,"search_a":"'-120975':12A,15A '-2026':11A,14A 'arista':1A,16A 'automat':7A 'certif':8A 'cve':10A,13A 'eo':2A 'eos':17A 'malici':3A 'packet':4A 'renew':9A 'stop':6A","search_b":"'arista':19B,29B 'arista-eo':18B 'autocertmgmt':48B 'automat':33B,37B 'break':59B 'ca':38B 'certif':27B,34B,39B,52B 'crash':46B 'depend':62B 'enabl':41B 'eo':20B,30B 'expir':58B 'gear':24B 'infrastructur':21B 'malici':43B 'manag':35B,50B 'may':57B 'network':23B 'network-gear':22B 'packet':44B 'process':49B 'renew':55B 'retriev':40B 'servic':63B 'stop':54B 'switch':31B 'tls':26B,61B 'tls-certif':25B 'tls-depend':60B 'x.509':51B","search_c":"'affect':65C 'arista':68C 'author':78C 'autocertmgmt':89C 'automat':71C,76C,102C 'ca':79C 'caus':87C 'certif':72C,77C,80C,97C 'configur':74C 'depend':111C 'disrupt':108C 'enabl':82C 'eo':69C 'eventu':105C 'expir':106C 'malici':84C 'manag':73C,95C 'may':86C,104C 'packet':85C 'platform':66C 'potenti':107C 'process':90C 'renew':101C 'retriev':81C 'run':67C 'servic':112C 'termin':93C 'tls':110C 'tls-depend':109C 'unexpect':94C 'x.509':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120975","severity":null,"published_at":"2026-11-10T20:18:52+00:00","modified_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}