{"id":"CVE-2026-121368","kind":"vulnerability","aliases":["CVE-2026-121368"],"related":[],"title":"Arista EOS: crafted BFD packet with keyed MD5 or SHA1 reboots device","description":"On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.","summary":"On Arista EOS devices configured with Bidirectional Forwarding Detection using keyed MD5 or keyed SHA1 authentication, a specially crafted BFD packet causes the system to reboot. An unauthenticated attacker with network adjacency to a BFD-enabled interface can trigger the reboot repeatedly to take the device offline.","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EOS","fixed":["4.37.0F","4.36.3M","4.35.7M","4.34.9M","4.33.11M"],"affected":"<= 4.36.2F (4.36.x), <= 4.35.6M, <= 4.34.8M, <= 4.33.10M, all 4.32.x, all EOL trains back to 4.22.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["arista-eos","bfd","infrastructure","network-devices","self-hosted"],"not_affected_if":["bfd-not-configured","network-isolated","no-bfd-md5-sha1-auth","no-keyed-md5-or-sha1"],"how_to_check":"Run 'show running-config section router bfd' and 'show running-config section bfd' (per-interface config overrides global). Exposed if 'authentication mode md5|sha1 shared-secret profile <name>' (optionally 'meticulous') is configured with live BFD sessions. 'show bfd peers detail' shows 'Authentication mode: Keyed Sha1/Keyed Md5/Meticulous Sha1/Meticulous Md5'. Then compare 'show version' to affected releases. IoC: kernel panic/unexpected reboot; rbfd log lines (/var/log/rbfd.log, or /var/log/messages before 4.30.0F) when 'debug rbfd 2' is set.","fix":"Upgrade EOS to 4.37.0F or later, 4.36.3M, 4.35.7M, 4.34.9M or 4.33.11M (or later in the same train). No hotfix; Arista lists no mitigation.","status":"open","published_at":"2026-11-10T20:18:56+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","triaged_at":"2026-11-10T20:47:22+00:00","updated_at":"2026-11-10T20:56:30+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T20:47:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: crafted BFD packet with keyed MD5 or SHA1 reboots device","impact":"medium","summary":"On Arista EOS devices configured with Bidirectional Forwarding Detection using keyed MD5 or keyed SHA1 authentication, a specially crafted BFD packet causes the system to reboot. An unauthenticated attacker with network adjacency to a BFD-enabled interface can trigger the reboot repeatedly to take the device offline.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","network-devices","bfd"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Device reboots repeatedly, causing network outage","analyst_note":"Confirm affected EOS version ranges and fixed releases from the Arista security advisory; the NVD entry alone gives no versions.","how_to_check":"- Check whether BFD is configured with keyed MD5 or keyed SHA1 authentication on the device (`show running-config | include bfd`)\n- Confirm the installed EOS version (`show version`) against the affected ranges in the vendor advisory\n- unknown for any further check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["bfd-not-configured","no-keyed-md5-or-sha1","network-isolated"],"who_is_affected":"Only Arista EOS devices that run BFD with keyed MD5 or keyed SHA1 authentication are exposed. An attacker needs to be on a network adjacent to a BFD-enabled interface, directly or over multiple hops. Devices without BFD or with BFD authentication disabled or using other methods are not affected according to the description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000781,"input_tokens":4576,"output_tokens":647,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected EOS version ranges and fixed releases from the Arista security advisory; the NVD entry alone gives no versions.","search":"'-121368':15A,18A '-2026':14A,17A 'adjac':62B,104C 'affect':80C 'arista':1A,21B,32B,83C 'arista-eo':20B 'attack':59B,101C 'authent':46B,98C 'bfd':4A,23B,50B,66B,89C,113C,121C 'bfd-enabl':65B,112C 'bidirect':37B,86C 'caus':52B 'configur':35B,90C 'craft':3A,49B,120C 'cve':13A,16A 'detect':39B,88C 'devic':12A,27B,34B,77B 'direct':105C 'enabl':67B,114C 'eo':2A,22B,33B,84C 'eos':19A 'forward':38B,87C 'hop':109C 'host':30B 'infrastructur':24B 'interfac':68B,115C 'key':7A,41B,44B,93C,96C 'md5':8A,42B,94C 'multi':108C 'multi-hop':107C 'network':26B,61B,103C 'network-devic':25B 'offlin':78B 'packet':5A,51B,122C 'platform':81C 'reboot':11A,56B,72B,127C 'repeat':73B 'result':123C 'run':82C 'self':29B 'self-host':28B 'send':117C 'sha1':10A,45B,97C 'special':48B,119C 'system':54B,126C 'take':75B 'trigger':70B 'unauthent':58B,100C 'use':40B,92C","nicknames":[],"mitigations":[],"who_affected":"Arista EOS devices (switches, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange) running BFD with keyed MD5 or keyed SHA1 authentication (also meticulous mode). An unauthenticated attacker with direct or multi-hop network reachability to a BFD-enabled interface can send one crafted packet and reboot the device. Skip if BFD is unused or has no MD5/SHA1 authentication, or you run MOS, NetVisor, CloudVision Portal, CCF, DMF or VeloCloud, which Arista lists as not affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:56:30Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206","run_id":2725},"products":{"at":"2026-11-10T20:56:30Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206","run_id":2725},"how_to_check":{"at":"2026-11-10T20:56:30Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206","run_id":2725},"who_affected":{"at":"2026-11-10T20:56:30Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206","run_id":2725}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["eos"],"ptokens":["eos"],"labels":["aristaeos","bfd","high","infrastructure","networkdevices","selfhosted"],"campaign_type":null,"search_a":"'-121368':15A,18A '-2026':14A,17A 'arista':1A 'bfd':4A 'craft':3A 'cve':13A,16A 'devic':12A 'eo':2A 'eos':19A 'key':7A 'md5':8A 'packet':5A 'reboot':11A 'sha1':10A","search_b":"'adjac':62B 'arista':21B,32B 'arista-eo':20B 'attack':59B 'authent':46B 'bfd':23B,50B,66B 'bfd-enabl':65B 'bidirect':37B 'caus':52B 'configur':35B 'craft':49B 'detect':39B 'devic':27B,34B,77B 'enabl':67B 'eo':22B,33B 'forward':38B 'host':30B 'infrastructur':24B 'interfac':68B 'key':41B,44B 'md5':42B 'network':26B,61B 'network-devic':25B 'offlin':78B 'packet':51B 'reboot':56B,72B 'repeat':73B 'self':29B 'self-host':28B 'sha1':45B 'special':48B 'system':54B 'take':75B 'trigger':70B 'unauthent':58B 'use':40B","search_c":"'adjac':104C 'affect':80C 'arista':83C 'attack':101C 'authent':98C 'bfd':89C,113C,121C 'bfd-enabl':112C 'bidirect':86C 'configur':90C 'craft':120C 'detect':88C 'direct':105C 'enabl':114C 'eo':84C 'forward':87C 'hop':109C 'interfac':115C 'key':93C,96C 'md5':94C 'multi':108C 'multi-hop':107C 'network':103C 'packet':122C 'platform':81C 'reboot':127C 'result':123C 'run':82C 'send':117C 'sha1':97C 'special':119C 'system':126C 'unauthent':100C 'use':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121368","severity":null,"published_at":"2026-11-10T20:18:56+00:00","modified_at":"2026-11-10T20:18:56+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121368:2725","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206","severity":null,"published_at":"2026-11-10T20:56:30+00:00","modified_at":"2026-11-10T20:56:30+00:00","first_seen_at":"2026-11-10T20:56:30+00:00","fetched_at":"2026-11-10T20:56:30+00:00","note":"Read Arista SA 0206 (primary): versions, fixes, config check, no mitigation/hotfix, not exploited per vendor. No social search (published today).","cites":["https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206"]}],"documents":[{"id":118334,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206","title":"Arista Security Advisory 0206","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}