{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 208 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208" } ], "title": "Security Advisory 208", "tracking": { "current_release_date": "2026-11-08T09:58:18Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 208", "initial_release_date": "2026-11-08T09:58:18Z", "revision_history": [ { "date": "2026-11-08T09:58:18Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.25.1", "product": { "name": "EOS version 4.25.1", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 4.35.7", "product": { "name": "EOS version 4.35.7", "product_id": "CSAFPID-2" } }, { "category": "product_version", "name": "EOS version 4.36.3", "product": { "name": "EOS version 4.36.3", "product_id": "CSAFPID-4" } }, { "category": "product_version", "name": "EOS version 4.37.0", "product": { "name": "EOS version 4.37.0", "product_id": "CSAFPID-3" } }, { "category": "product_version", "name": "EOS version 4.34.9", "product": { "name": "EOS version 4.34.9", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.33.11", "product": { "name": "EOS version 4.33.11", "product_id": "CSAFPID-0" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-121289", "id": { "system_name": "Arista Bug ID", "text": "1927959" }, "notes": [ { "category": "description", "text": "On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.\n\nSuccessful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.", "title": "CVE Description" }, { "category": "other", "text": "In order to be vulnerable to CVE-2026-121289, the following condition must be met:\n\nBGP must be configured AND the multi-agent routing protocol model must be in use:\n\n```\nswitch>show ip bgp summary\nBGP summary information for VRF default\nRouter identifier 10.0.0.1, local AS number 65000\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\n 10.0.0.2 4 65001 100 100 0 0 01:00:00 Estab 10 10\n\nswitch>show running-config all | inc service routing protocols\nservice routing protocols model multi-agent\n```\n\nThe vulnerable code paths are active whenever BGP is enabled and a BGP peering session is established.\n\nIf BGP is not configured OR if the multi-agent routing protocol model is not in use there is no exposure to this issue and the output will look something like:\n\n```\nswitch>show ip bgp summary \n% BGP is not running\nswitch>show run all | inc service routing protocols\nservice routing protocols model ribd\n```", "title": "1927959: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-5" ], "fixed": [ "CSAFPID-0", "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-4" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121289" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.11", "product_ids": [ "CSAFPID-0" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.9", "product_ids": [ "CSAFPID-1" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.7", "product_ids": [ "CSAFPID-2" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.3", "product_ids": [ "CSAFPID-4" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.37.0", "product_ids": [ "CSAFPID-3" ] }, { "category": "none_available", "details": "Not fixed in EOS version 4.25.1", "product_ids": [ "CSAFPID-5" ] }, { "category": "mitigation", "details": "For BGP sessions that do not rely on the Tunnel Encapsulation Attribute, a workaround is to remove all received Tunnel Encapsulation Attributes by [configuring attribute discard](https://www.arista.com/ko/support/toi/eos-4-29-2f/17038-ignore-received-bgp-attributes), for example:\n\n```\nneighbor default received attribute discard 23\n```\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using [TCP-AO](https://www.arista.com/ko/support/toi/eos-4-28-2f/16087-bgp-tcp-authentication-option-tcp-ao) in order to ensure that only authorized peers can establish a BGP session." } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1", "CSAFPID-0", "CSAFPID-5", "CSAFPID-3", "CSAFPID-2", "CSAFPID-4" ] } ], "title": "CVE-2026-121289" } ] }