---
id: "CVE-2026-121368"
page: "https://infrastack.ai/live/CVE-2026-121368"
kind: "vulnerability"
aliases: ["CVE-2026-121368"]
title: "Arista EOS: crafted BFD packet with keyed MD5 or SHA1 reboots device"
severity: "high"
cvss: 8.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EOS", "fixed": ["4.37.0F", "4.36.3M", "4.35.7M", "4.34.9M", "4.33.11M"], "affected": "<= 4.36.2F (4.36.x), <= 4.35.6M, <= 4.34.8M, <= 4.33.10M, all 4.32.x, all EOL trains back to 4.22.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["arista-eos", "bfd", "infrastructure", "network-devices", "self-hosted"]
not_affected_if: ["bfd-not-configured", "network-isolated", "no-bfd-md5-sha1-auth", "no-keyed-md5-or-sha1"]
published_at: "2026-11-10T20:18:56+00:00"
first_seen_at: "2026-11-10T20:46:04+00:00"
updated_at: "2026-11-10T20:56:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121368", "first_seen_at": "2026-11-10T20:46:04+00:00"}, {"source": "analyst", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206", "first_seen_at": "2026-11-10T20:56:30+00:00", "cites": ["https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206"]}]
exploit_sources: []
---

# Arista EOS: crafted BFD packet with keyed MD5 or SHA1 reboots device

Link for people: https://infrastack.ai/live/CVE-2026-121368 (this .md is for agents)

On Arista EOS devices configured with Bidirectional Forwarding Detection using keyed MD5 or keyed SHA1 authentication, a specially crafted BFD packet causes the system to reboot. An unauthenticated attacker with network adjacency to a BFD-enabled interface can trigger the reboot repeatedly to take the device offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EOS affected <= 4.36.2F (4.36.x), <= 4.35.6M, <= 4.34.8M, <= 4.33.10M, all 4.32.x, all EOL trains back to 4.22.0 fixed 4.37.0F, 4.36.3M, 4.35.7M, 4.34.9M, 4.33.11M

## How to check

Run 'show running-config section router bfd' and 'show running-config section bfd' (per-interface config overrides global). Exposed if 'authentication mode md5|sha1 shared-secret profile <name>' (optionally 'meticulous') is configured with live BFD sessions. 'show bfd peers detail' shows 'Authentication mode: Keyed Sha1/Keyed Md5/Meticulous Sha1/Meticulous Md5'. Then compare 'show version' to affected releases. IoC: kernel panic/unexpected reboot; rbfd log lines (/var/log/rbfd.log, or /var/log/messages before 4.30.0F) when 'debug rbfd 2' is set.

## Fix

Upgrade EOS to 4.37.0F or later, 4.36.3M, 4.35.7M, 4.34.9M or 4.33.11M (or later in the same train). No hotfix; Arista lists no mitigation.

## Timeline

- 2026-11-10T20:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121368
- 2026-11-10T20:56:30+00:00 analyst https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206 — Read Arista SA 0206 (primary): versions, fixes, config check, no mitigation/hotfix, not exploited per vendor. No social search (published today).

## Documents

- [advisory] Arista Security Advisory 0206 https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206

## From the sources

On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_