{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 207 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25029-security-advisory-0207" } ], "title": "Security Advisory 207", "tracking": { "current_release_date": "2026-11-08T09:58:21Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 207", "initial_release_date": "2026-11-08T09:58:21Z", "revision_history": [ { "date": "2026-11-08T09:58:21Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.33.11", "product": { "name": "EOS version 4.33.11", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 4.34.9", "product": { "name": "EOS version 4.34.9", "product_id": "CSAFPID-7" } }, { "category": "product_version", "name": "EOS version 1.0.0", "product": { "name": "EOS version 1.0.0", "product_id": "CSAFPID-10" } }, { "category": "product_version", "name": "EOS version 4.35.7", "product": { "name": "EOS version 4.35.7", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.36.3", "product": { "name": "EOS version 4.36.3", "product_id": "CSAFPID-9" } }, { "category": "product_version", "name": "EOS version 4.37.0", "product": { "name": "EOS version 4.37.0", "product_id": "CSAFPID-8" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-120982", "id": { "system_name": "Arista Bug ID", "text": "1927714" }, "notes": [ { "category": "description", "text": "On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding.", "title": "CVE Description" }, { "category": "other", "text": "In order to be vulnerable to CVE-2026-120982, BGP must be configured AND the multi-agent routing protocol model must be in use on the device:\n\n```\nswitch>show ip bgp summary\nBGP router identifier X.X.X.X, local AS number XXXXX\n...\nNeighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\nX.X.X.X 4 XXXXX 100 100 0 0 01:00:00 Estab 10 10\n\nswitch>show running-config all | inc service routing protocols\nservice routing protocols model multi-agent\n```\n\nIf BGP is not configured OR if the multi-agent routing protocol model is not in use there is no exposure to this issue and the output will look like:\n\n```\nswitch>show ip bgp summary\n% BGP is not active\nswitch>show run all | inc service routing protocols\nservice routing protocols model ribd\n```", "title": "1927714: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-10" ], "fixed": [ "CSAFPID-1", "CSAFPID-5", "CSAFPID-7", "CSAFPID-8", "CSAFPID-9" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-120982" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.11", "product_ids": [ "CSAFPID-5" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.9", "product_ids": [ "CSAFPID-7" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.7", "product_ids": [ "CSAFPID-1" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.3", "product_ids": [ "CSAFPID-9" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.37.0", "product_ids": [ "CSAFPID-8" ] }, { "category": "none_available", "details": "Not fixed in EOS version 1.0.0", "product_ids": [ "CSAFPID-10" ] }, { "category": "mitigation", "details": "A workaround is to configure attribute discard: \n\n```\nrouter bgp \n neighbor default received attribute discard 22\n```\n\nThe above configuration applies the mitigation globally. The attribute can be re-enabled on specific peers if it is required within the customer application. For example:\n\n```\nrouter bgp \n no neighbor X.X.X.X received attribute discard 22\n```\n\nThe `show bgp neighbors` output can be used verify the configuration is applied correctly per peer:\n\n```\nswitch> show bgp neighbors\n\u2026\n Configured received path attribute types to discard: 22\n```\n\nThe \"Configured received path attribute types to discard\" will not be present or not contain the affected attribute if the configuration is not applied on a peer.\n\nNote that enabling the attribute on any peer restores exposure to the issue.\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using [TCP-AO](https://www.arista.com/ko/support/toi/eos-4-28-2f/16087-bgp-tcp-authentication-option-tcp-ao) in order to ensure that only authorized peers can establish a BGP session." } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-10", "CSAFPID-8", "CSAFPID-5", "CSAFPID-7", "CSAFPID-9" ] } ], "title": "CVE-2026-120982" } ] }