{"id":"CVE-2026-121287","kind":"vulnerability","aliases":["CVE-2026-121287"],"related":[],"title":"Arista EOS: crafted RIPv2 packets crash the Rip agent on RIP interfaces with MD5 authentication","description":"An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device.","summary":"Arista EOS: an unauthenticated attacker on an adjacent segment can send crafted RIPv2 packets that crash the Rip agent; repeated attacks interrupt routing, and Arista says code execution is possible in a worst case. Needs RIP enabled with MD5 auth on an interface. Found internally; Arista knows of no exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EOS","fixed":["4.36.3M","4.35.7M","4.34.9M","4.33.11M"],"affected":"4.37.0F; <= 4.36.2F; <= 4.35.6M; <= 4.34.8M; <= 4.33.10M; all 4.32.x and end-of-support trains","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent-network","arista","eos","infrastructure","network-infrastructure","network-switch","rip","routers"],"not_affected_if":["no-adjacent-untrusted-segment","no-md5-auth-on-rip-interface","rip-disabled"],"how_to_check":"Vulnerable only if all three hold (Arista): RIP enabled; MD5 authentication configured on an interface; RIP network statement matches that interface's IP. Run 'show running-config | section router rip' and 'show running-config interfaces <name>' (look for 'rip authentication algorithm md5'). Check EOS version with 'show version'. After the fact: 'show logging | include Rip' for Rip process terminated/restarted messages.","fix":"Upgrade EOS to 4.36.3M or later (4.36.x), 4.35.7M or later (4.35.x), 4.34.9M or later (4.34.x), or 4.33.11M or later (4.33.x). Arista lists no fix for 4.37.0F, the 4.32.x train or end-of-support trains; no hotfix exists. Fixes also cover CVE-2026-121288.","status":"resolved","published_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","triaged_at":"2026-11-10T20:47:25+00:00","updated_at":"2026-11-10T20:57:41+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T20:47:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Network routers: crafted RIPv2 packets crash the RIP routing agent","impact":"high","summary":"A crafted RIPv2 routing packet sent from an adjacent network segment crashes the RIP agent on a device with RIP enabled on an interface. Repeated attacks reliably stop routing on that device, and the sources say arbitrary code execution is possible in a worst case.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["rip","routers","network-infrastructure"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Routing service stops; sources say arbitrary code may run on device","analyst_note":"Identify the affected vendor and product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121287, then find its fixed versions and the RIP disable setting.","how_to_check":"- Check whether RIP is enabled on any interface of the device (the sources do not name the configuration command).\n- unknown for the exact product versions, since the source lists no products.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["rip-disabled","no-adjacent-untrusted-segment"],"who_is_affected":"Devices that run RIPv2 routing on an interface reachable from an adjacent network segment are exposed. Devices with RIP disabled, or with no RIP-enabled interface facing an untrusted segment, can likely skip it. The sources do not name the affected products or versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4607,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected vendor and product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121287, then find its fixed versions and the RIP disable setting.","search":"'-121287':18A,21A '-2026':17A,20A 'adjac':24B,44B,92C 'adjacent-network':23B 'affect':127C,159C 'agent':9A,55B,113C 'allow':150C 'also':131C 'arbitrari':155C 'arista':1A,26B,37B,61B,82B 'attack':41B,57B,89C,152C 'auth':76B 'authent':15A 'case':70B,145C 'code':63B,156C 'craft':3A,48B,97C 'crash':6A,52B,114C 'credenti':118C 'cve':16A,19A 'depend':138C 'devic':108C,128C,136C,160C 'disrupt':132C 'enabl':73B,104C 'eo':2A,27B,38B 'eos':22A 'execut':64B,154C 'exploit':86B,120C 'found':80B 'infrastructur':28B,31B 'interfac':12A,79B,105C 'intern':81B 'interrupt':58B,122C 'know':83B 'may':130C,149C 'md5':14A,75B 'need':71B 'network':25B,30B,33B,93C 'network-infrastructur':29B 'network-switch':32B 'packet':5A,50B,99C 'possibl':66B 'provid':116C 'reliabl':121C 'repeat':56B,119C 'rip':8A,11A,35B,54B,72B,103C,112C 'rip-en':102C 'ripv2':4A,49B,98C 'rout':59B,123C,133C 'router':36B 'say':62B 'scenario':146C 'segment':45B,94C 'send':47B,96C 'servic':124C 'switch':34B 'trigger':110C 'unauthent':40B,88C 'valid':117C 'vulner':148C 'without':115C 'worst':69B,144C 'worst-cas':143C","nicknames":[],"mitigations":[],"who_affected":"Devices that run RIPv2 routing on an interface reachable from an adjacent network segment are exposed. Devices with RIP disabled, or with no RIP-enabled interface facing an untrusted segment, can likely skip it. The sources do not name the affected products or versions.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:57:41Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","run_id":2731},"products":{"at":"2026-11-10T20:57:41Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","run_id":2731},"mitigations":{"at":"2026-11-10T20:57:41Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","run_id":2731},"workarounds":{"at":"2026-11-10T20:57:41Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","run_id":2731},"how_to_check":{"at":"2026-11-10T20:57:41Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","run_id":2731},"who_affected":{"at":"2026-11-10T20:57:41Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","run_id":2731}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["eos"],"ptokens":["eos"],"labels":["adjacentnetwork","arista","eos","high","infrastructure","networkinfrastructure","networkswitch","rip","routers"],"campaign_type":null,"search_a":"'-121287':18A,21A '-2026':17A,20A 'agent':9A 'arista':1A 'authent':15A 'craft':3A 'crash':6A 'cve':16A,19A 'eo':2A 'eos':22A 'interfac':12A 'md5':14A 'packet':5A 'rip':8A,11A 'ripv2':4A","search_b":"'adjac':24B,44B 'adjacent-network':23B 'agent':55B 'arista':26B,37B,61B,82B 'attack':41B,57B 'auth':76B 'case':70B 'code':63B 'craft':48B 'crash':52B 'enabl':73B 'eo':27B,38B 'execut':64B 'exploit':86B 'found':80B 'infrastructur':28B,31B 'interfac':79B 'intern':81B 'interrupt':58B 'know':83B 'md5':75B 'need':71B 'network':25B,30B,33B 'network-infrastructur':29B 'network-switch':32B 'packet':50B 'possibl':66B 'repeat':56B 'rip':35B,54B,72B 'ripv2':49B 'rout':59B 'router':36B 'say':62B 'segment':45B 'send':47B 'switch':34B 'unauthent':40B 'worst':69B","search_c":"'adjac':92C 'affect':127C,159C 'agent':113C 'allow':150C 'also':131C 'arbitrari':155C 'attack':89C,152C 'case':145C 'code':156C 'craft':97C 'crash':114C 'credenti':118C 'depend':138C 'devic':108C,128C,136C,160C 'disrupt':132C 'enabl':104C 'execut':154C 'exploit':120C 'interfac':105C 'interrupt':122C 'may':130C,149C 'network':93C 'packet':99C 'provid':116C 'reliabl':121C 'repeat':119C 'rip':103C,112C 'rip-en':102C 'ripv2':98C 'rout':123C,133C 'scenario':146C 'segment':94C 'send':96C 'servic':124C 'trigger':110C 'unauthent':88C 'valid':117C 'vulner':148C 'without':115C 'worst':144C 'worst-cas':143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121287","severity":null,"published_at":"2026-11-10T20:18:53+00:00","modified_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","fetched_at":"2026-11-10T20:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121287:2731","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","severity":null,"published_at":"2026-11-10T20:57:41+00:00","modified_at":"2026-11-10T20:57:41+00:00","first_seen_at":"2026-11-10T20:57:41+00:00","fetched_at":"2026-11-10T20:57:41+00:00","note":"Arista Security Advisory 0221 read; fixed versions, config conditions, mitigation (shutdown router rip) from vendor page. Triage missed MD5 auth condition. Sibling CVE-2026-121288 (MD5 auth bypass) in same advisory. Not exploited per Arista; no PoC.","cites":["https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"]}],"documents":[{"id":118463,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221","title":"Arista Security Advisory 0221","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}