{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 206 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206" } ], "title": "Security Advisory 206", "tracking": { "current_release_date": "2026-11-08T09:58:20Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 206", "initial_release_date": "2026-11-08T09:58:20Z", "revision_history": [ { "date": "2026-11-08T09:58:20Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.22.0", "product": { "name": "EOS version 4.22.0", "product_id": "CSAFPID-6" } }, { "category": "product_version", "name": "EOS version 4.34.9", "product": { "name": "EOS version 4.34.9", "product_id": "CSAFPID-7" } }, { "category": "product_version", "name": "EOS version 4.33.11", "product": { "name": "EOS version 4.33.11", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 4.35.7", "product": { "name": "EOS version 4.35.7", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.36.3", "product": { "name": "EOS version 4.36.3", "product_id": "CSAFPID-9" } }, { "category": "product_version", "name": "EOS version 4.37.0", "product": { "name": "EOS version 4.37.0", "product_id": "CSAFPID-8" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-121368", "id": { "system_name": "Arista Bug ID", "text": "1965007" }, "notes": [ { "category": "description", "text": "On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.", "title": "CVE Description" }, { "category": "other", "text": "BFD authentication must be configured for either MD5 or SHA1 hashing. Either authentication scheme may optionally be configured to run in meticulous mode.\n\nTo check whether the device is affected, inspect the running configuration with the following show command:\n\nAny of the following configurations in use with live BFD sessions indicate the device is vulnerable:\n```\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode md5 shared-secret profile profile1\n```\n```\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode md5 shared-secret profile profile1 meticulous\n```\n```\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode sha1 shared-secret profile profile1 \n```\n```\nswitch(s1)#show running-config section router bfd\nrouter bfd\n authentication mode sha1 shared-secret profile profile1 meticulous\n```\nIf neither MD5 nor SHA1 authentication for BFD sessions are enabled, the above configurations will be missing from the output of \u201cshow running-config\u201d.\n\nNote that the same configuration item indicating BFD session authentication may also appear under the device\u2019s per-interface configuration.\n```\nswitch(s1)#show running-config section bfd\ninterface Ethernet1\n bfd authentication mode md5 shared-secret profile profile1\n```\nSession authentication configured per-interface takes precedence over device-wide authentication configuration. If all BFD sessions on a device have per-interface authentication configuration overriding global authentication then exposure is dependent on the per-interface configuration only, while it is in place.\n\nThe following show-command output indicates the authentication mode of each session:\n```\nswitch(s1)#show bfd peers detail\nVRF name: default\n-----------------\nPeer Addr 2001:db8::2, Intf Ethernet1, Type normal, Role active, State Up\nVRF default, LAddr 2001:db8::1, LD/RD 12345/67890\nSession state is Up and not using echo function\nHardware Acceleration: Async Off, Echo Off\nLast Up 11/04/26 10:00:00.123\nLast Down NA\nLast Diag: No Diagnostic\nAuthentication mode: Keyed Sha1\nShared-secret profile: BFD_KEYS\nTxInt: 300 ms, RxInt: 300 ms, Multiplier: 3\nReceived RxInt: 300 ms, Received Multiplier: 3\nRx Count: 13716, Rx Interval (ms) min/max/avg: 225/301/262 last: 104 ms ago\nTx Count: 13719, Tx Interval (ms) min/max/avg: 0/2/0 last: 87 ms ago\nDetect Time: 900 ms\nSched Delay: 1*TxInt: 13719, 2*TxInt: 0, 3*TxInt: 0, GT 3*TxInt: 0\nRegistered protocols: bgp\nUptime: 01:00:00.00\nLast packet: Version: 1 - Diagnostic: 0\n State bit: Up - Demand bit: 0\n Poll bit: 0 - Final bit: 0\n Multiplier: 3 - Length: 52\n My Discr.: 67890 - Your Discr.: 12345\n Min tx interval: 300 - Min rx interval: 300\n Min Echo interval: 0\n```\nAuthentication modes which may be shown in the above show-command output and indicate exposure include:\n* \u201cKeyed Sha1\u201d\n* \u201cKeyed Md5\u201d\n* \u201cMeticulous Sha1\u201d\n* \u201cMeticulous Md5\u201d\n", "title": "1965007: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-6" ], "fixed": [ "CSAFPID-1", "CSAFPID-5", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9" ] }, "references": [ { "category": "external", "summary": "MITRE CVE Entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121368" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.11", "product_ids": [ "CSAFPID-5" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.9", "product_ids": [ "CSAFPID-7" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.7", "product_ids": [ "CSAFPID-1" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.3", "product_ids": [ "CSAFPID-9" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.37.0", "product_ids": [ "CSAFPID-8" ] }, { "category": "none_available", "details": "Not fixed in EOS version 4.22.0", "product_ids": [ "CSAFPID-6" ] }, { "category": "mitigation", "details": "This vulnerability may lead to kernel-panic and unexpected reboot of the affected device.\n\nThe following kernel messages may also appear which indicate the issue:\n```\nrbfd Rx: Packet failed RFC validation due to 4\nrbfd Rx (1234): Packet failed auth check\n\nrbfd Rx (1234): key id not found 7\nrbfd Rx (1234): seqnum failed received 100 expected >= 101\nrbfd Rx (1234): seqnum failed received 100 expected > 101 and <= 102\nrbfd Rx (1234): auth ifindex 12 skb ifindex 15\n```\n\nIn all above examples, all reason code, discriminator, key ID, sequence number, and ifIndex values are subject to change depending on the customer configuration and BFD session state at the time of logging.\n\nThe above messages may appear in \u201c/var/log/messages\u201d if the device is running an EOS version prior to the 4.30.0F. All subsequent releases write rbfd logging to \u201c/var/log/rbfd.log\u201d. \n\nIn order for these logs to appear, configuration for elevated rbfd logging (level 2 or greater) must be present on the device, logging level can be checked with the below show command.\n```\nswitch(s1)#show running-config section router bfd\nrouter bfd\n debug rbfd 2\n```\n" } ], "scores": [ { "cvss_v3": { "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-8", "CSAFPID-5", "CSAFPID-7", "CSAFPID-6", "CSAFPID-9" ] } ], "title": "CVE-2026-121368" } ] }