{"id":"CVE-2026-121288","kind":"vulnerability","aliases":["CVE-2026-121288"],"related":[],"title":"Network router: RIPv2 MD5 authentication bypass lets attackers inject routes","description":"An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity.","summary":"A flaw lets an attacker on an adjacent network segment bypass RIPv2 MD5 authentication and have forged route updates accepted by the device. Injected routes can redirect traffic through attacker-controlled paths, create routing loops, or blackhole traffic.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","network-gear","ripv2","routers"],"not_affected_if":["no-md5-auth","no-rip","not-adjacent-segment"],"how_to_check":"- Check whether RIPv2 MD5 authentication is configured on any interface (on Arista EOS, look for 'router rip' and 'ip rip authentication mode md5' in show running-config).\n- Also check if you run Arista EOS: the CVSS was assigned by Arista's PSIRT, but no Arista advisory naming this CVE was found, so this is not confirmed. Watch https://www.arista.com/en/support/advisories-notices for the affected and fixed versions.","fix":null,"status":"open","published_at":"2026-11-10T20:18:54+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","triaged_at":"2026-11-10T20:47:38+00:00","updated_at":"2026-11-10T20:57:33+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T20:47:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Network router: RIPv2 MD5 authentication bypass lets attackers inject routes","impact":"high","summary":"A flaw lets an attacker on an adjacent network segment bypass RIPv2 MD5 authentication and have forged route updates accepted by the device. Injected routes can redirect traffic through attacker-controlled paths, create routing loops, or blackhole traffic.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ripv2","routers","network-gear"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reroutes or blackholes traffic on the network segment","analyst_note":"Identify the affected vendor and product and the fixed firmware versions; the NVD entry in the sources names no product or ranges.","how_to_check":"- Check whether RIPv2 MD5 authentication is configured on any interface of the device.\n- Confirm the device's firmware or software version against the vendor's advisory, which the sources do not name.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-rip","no-md5-auth","not-adjacent-segment"],"who_is_affected":"Only devices that run RIPv2 with MD5 authentication configured on an interface are exposed, because the flaw requires that setting. An attacker must sit on an adjacent network segment that can send RIPv2 packets to the device. Networks that do not use RIP, or that use no RIPv2 MD5 authentication, can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4611,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected vendor and product and the fixed firmware versions; the NVD entry in the sources names no product or ranges.","search":"'-121288':13A,16A '-2026':12A,15A 'accept':42B,80C 'adjac':30B,67C 'affect':95C 'attack':8A,27B,53B,64C,98C,118C 'attacker-control':52B,117C 'authent':5A,36B,73C,90C 'blackhol':60B,125C 'bypass':6A,33B,71C 'caus':106C 'configur':92C 'connect':129C 'control':54B,119C 'could':105C 'craft':102C 'creat':56B,121C 'cve':11A,14A 'devic':45B,83C,108C 'disrupt':127C 'exploit':85C 'flaw':24B 'forg':39B 'gear':20B 'infrastructur':17B 'inject':9A,46B,101C 'instal':110C 'interfac':96C 'let':7A,25B 'loop':58B,123C 'md5':4A,35B,72C,89C 'network':1A,19B,31B,68C,114C,128C 'network-gear':18B 'packet':104C 'path':55B,120C 'redirect':49B,113C 'requir':86C 'rip':77C 'ripv2':3A,21B,34B,88C,103C 'rout':10A,40B,47B,57B,78C,111C,122C 'router':2A,22B 'segment':32B,69C 'success':84C 'traffic':50B,61B,115C,126C 'unauthent':63C 'unauthor':76C 'updat':41B,79C","nicknames":[],"mitigations":[],"who_affected":"Only devices that run RIPv2 with MD5 authentication configured on an interface are exposed, because the flaw requires that setting. An attacker must sit on an adjacent network segment that can send RIPv2 packets to the device. Networks that do not use RIP, or that use no RIPv2 MD5 authentication, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","networkgear","ripv2","routers"],"campaign_type":null,"search_a":"'-121288':13A,16A '-2026':12A,15A 'attack':8A 'authent':5A 'bypass':6A 'cve':11A,14A 'inject':9A 'let':7A 'md5':4A 'network':1A 'ripv2':3A 'rout':10A 'router':2A","search_b":"'accept':42B 'adjac':30B 'attack':27B,53B 'attacker-control':52B 'authent':36B 'blackhol':60B 'bypass':33B 'control':54B 'creat':56B 'devic':45B 'flaw':24B 'forg':39B 'gear':20B 'infrastructur':17B 'inject':46B 'let':25B 'loop':58B 'md5':35B 'network':19B,31B 'network-gear':18B 'path':55B 'redirect':49B 'ripv2':21B,34B 'rout':40B,47B,57B 'router':22B 'segment':32B 'traffic':50B,61B 'updat':41B","search_c":"'accept':80C 'adjac':67C 'affect':95C 'attack':64C,98C,118C 'attacker-control':117C 'authent':73C,90C 'blackhol':125C 'bypass':71C 'caus':106C 'configur':92C 'connect':129C 'control':119C 'could':105C 'craft':102C 'creat':121C 'devic':83C,108C 'disrupt':127C 'exploit':85C 'inject':101C 'instal':110C 'interfac':96C 'loop':123C 'md5':72C,89C 'network':68C,114C,128C 'packet':104C 'path':120C 'redirect':113C 'requir':86C 'rip':77C 'ripv2':88C,103C 'rout':78C,111C,122C 'segment':69C 'success':84C 'traffic':115C,126C 'unauthent':63C 'unauthor':76C 'updat':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121288","severity":null,"published_at":"2026-11-10T20:18:54+00:00","modified_at":"2026-11-10T20:18:54+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","fetched_at":"2026-11-10T20:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121288:2730","url":null,"severity":null,"published_at":"2026-11-10T20:57:33+00:00","modified_at":"2026-11-10T20:57:33+00:00","first_seen_at":"2026-11-10T20:57:33+00:00","fetched_at":"2026-11-10T20:57:33+00:00","note":"NVD gives no product. CVSS was assigned by psirt@arista.com, so Arista is a likely vendor, but no Arista advisory naming this CVE was found (the Sept 2026 advisories cover VRRP and OSPF, not RIP). Vendor, product and fixed versions are unconfirmed; nothing verified. Revisit when Arista publishes an advisory."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}