---
id: "CVE-2026-121287"
page: "https://infrastack.ai/live/CVE-2026-121287"
kind: "vulnerability"
aliases: ["CVE-2026-121287"]
title: "Arista EOS: crafted RIPv2 packets crash the Rip agent on RIP interfaces with MD5 authentication"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "resolved"
category: "infrastructure"
products: [{"name": "EOS", "fixed": ["4.36.3M", "4.35.7M", "4.34.9M", "4.33.11M"], "affected": "4.37.0F; <= 4.36.2F; <= 4.35.6M; <= 4.34.8M; <= 4.33.10M; all 4.32.x and end-of-support trains", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adjacent-network", "arista", "eos", "infrastructure", "network-infrastructure", "network-switch", "rip", "routers"]
not_affected_if: ["no-adjacent-untrusted-segment", "no-md5-auth-on-rip-interface", "rip-disabled"]
published_at: "2026-11-10T20:18:53+00:00"
first_seen_at: "2026-11-10T20:46:03+00:00"
updated_at: "2026-11-10T20:57:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121287", "first_seen_at": "2026-11-10T20:46:03+00:00"}, {"source": "analyst", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221", "first_seen_at": "2026-11-10T20:57:41+00:00", "cites": ["https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"]}]
exploit_sources: []
---

# Arista EOS: crafted RIPv2 packets crash the Rip agent on RIP interfaces with MD5 authentication

Link for people: https://infrastack.ai/live/CVE-2026-121287 (this .md is for agents)

Arista EOS: an unauthenticated attacker on an adjacent segment can send crafted RIPv2 packets that crash the Rip agent; repeated attacks interrupt routing, and Arista says code execution is possible in a worst case. Needs RIP enabled with MD5 auth on an interface. Found internally; Arista knows of no exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EOS affected 4.37.0F; <= 4.36.2F; <= 4.35.6M; <= 4.34.8M; <= 4.33.10M; all 4.32.x and end-of-support trains fixed 4.36.3M, 4.35.7M, 4.34.9M, 4.33.11M

## How to check

Vulnerable only if all three hold (Arista): RIP enabled; MD5 authentication configured on an interface; RIP network statement matches that interface's IP. Run 'show running-config | section router rip' and 'show running-config interfaces <name>' (look for 'rip authentication algorithm md5'). Check EOS version with 'show version'. After the fact: 'show logging | include Rip' for Rip process terminated/restarted messages.

## Fix

Upgrade EOS to 4.36.3M or later (4.36.x), 4.35.7M or later (4.35.x), 4.34.9M or later (4.34.x), or 4.33.11M or later (4.33.x). Arista lists no fix for 4.37.0F, the 4.32.x train or end-of-support trains; no hotfix exists. Fixes also cover CVE-2026-121288.

## Timeline

- 2026-11-10T20:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121287
- 2026-11-10T20:57:41+00:00 analyst https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221 — Arista Security Advisory 0221 read; fixed versions, config conditions, mitigation (shutdown router rip) from vendor page. Triage missed MD5 auth condition. Sibling CVE-2026-121288 (MD5 auth bypass) in same advisory. Not exploited per Arista; no PoC.

## Documents

- [advisory] Arista Security Advisory 0221 https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221

## From the sources

An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_