---
id: "CVE-2026-121288"
page: "https://infrastack.ai/live/CVE-2026-121288"
kind: "vulnerability"
aliases: ["CVE-2026-121288"]
title: "Network router: RIPv2 MD5 authentication bypass lets attackers inject routes"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "network-gear", "ripv2", "routers"]
not_affected_if: ["no-md5-auth", "no-rip", "not-adjacent-segment"]
published_at: "2026-11-10T20:18:54+00:00"
first_seen_at: "2026-11-10T20:46:03+00:00"
updated_at: "2026-11-10T20:57:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121288", "first_seen_at": "2026-11-10T20:46:03+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:57:33+00:00"}]
exploit_sources: []
---

# Network router: RIPv2 MD5 authentication bypass lets attackers inject routes

Link for people: https://infrastack.ai/live/CVE-2026-121288 (this .md is for agents)

A flaw lets an attacker on an adjacent network segment bypass RIPv2 MD5 authentication and have forged route updates accepted by the device. Injected routes can redirect traffic through attacker-controlled paths, create routing loops, or blackhole traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether RIPv2 MD5 authentication is configured on any interface (on Arista EOS, look for 'router rip' and 'ip rip authentication mode md5' in show running-config).
- Also check if you run Arista EOS: the CVSS was assigned by Arista's PSIRT, but no Arista advisory naming this CVE was found, so this is not confirmed. Watch https://www.arista.com/en/support/advisories-notices for the affected and fixed versions.

## Timeline

- 2026-11-10T20:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121288
- 2026-11-10T20:57:33+00:00 analyst — NVD gives no product. CVSS was assigned by psirt@arista.com, so Arista is a likely vendor, but no Arista advisory naming this CVE was found (the Sept 2026 advisories cover VRRP and OSPF, not RIP). Vendor, product and fixed versions are unconfirmed; nothing verified. Revisit when Arista publishes an advisory.

## From the sources

An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_