EOS · CVE-2026-121287 · Infrastructure
FIX → 4.36.3M +3 ✓ verified
Arista EOS: an unauthenticated attacker on an adjacent segment can send crafted RIPv2 packets that crash the Rip agent; repeated attacks interrupt routing, and Arista says code execution is possible in a worst case. Needs RIP enabled with MD5 auth on an interface. Found internally; Arista knows of no exploitation.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Devices that run RIPv2 routing on an interface reachable from an adjacent network segment are exposed. Devices with RIP disabled, or with no RIP-enabled interface facing an untrusted segment, can likely skip it. The sources do not name the affected products or versions.
Not affected if no-adjacent-untrusted-segment, no-md5-auth-on-rip-interface, rip-disabled
Who cares adjacent-network, arista, eos, network-infrastructure, network-switch, rip, routers
show running-config | section router rip and show running-config interfaces <name> (look for rip authentication algorithm md5)An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
show versionshow logging | include Rip for Rip process terminated/restarted messagesUpgrade to 4.36.3M +3