{
  "document": {
    "category": "security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "contact_details": "support@arista.com",
      "name": "Arista PSIRT",
      "namespace": "https://www.arista.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Security advisory 209 canonical URL",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25031-security-advisory-0209"
      }
    ],
    "title": "Security Advisory 209",
    "tracking": {
      "current_release_date": "2026-11-08T09:58:22Z",
      "generator": {
        "engine": {
          "name": "Arista Networks SecEng Service CSAF Generator"
        }
      },
      "id": "Arista Networks Security Advisory 209",
      "initial_release_date": "2026-11-08T09:58:22Z",
      "revision_history": [
        {
          "date": "2026-11-08T09:58:22Z",
          "number": "1",
          "summary": "Document created"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "EOS version 4.35.7",
                    "product": {
                      "name": "EOS version 4.35.7",
                      "product_id": "CSAFPID-2"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.36.3",
                    "product": {
                      "name": "EOS version 4.36.3",
                      "product_id": "CSAFPID-4"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.37.0",
                    "product": {
                      "name": "EOS version 4.37.0",
                      "product_id": "CSAFPID-3"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.34.9",
                    "product": {
                      "name": "EOS version 4.34.9",
                      "product_id": "CSAFPID-1"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.33.11",
                    "product": {
                      "name": "EOS version 4.33.11",
                      "product_id": "CSAFPID-0"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 1.0.0",
                    "product": {
                      "name": "EOS version 1.0.0",
                      "product_id": "CSAFPID-7"
                    }
                  }
                ],
                "category": "product_name",
                "name": "EOS"
              }
            ],
            "category": "product_family",
            "name": "Software Products"
          }
        ],
        "category": "vendor",
        "name": "Arista Networks, Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-121290",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "1977472"
      },
      "notes": [
        {
          "category": "description",
          "text": "On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.",
          "title": "CVE Description"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-121290, the following conditions must all be met:\n\n1. The BGP listen port must be set to a non-default value (something other than TCP port 179):\n\n```\nswitch>show running-config section bgp | include listen-port\n  bgp transport listen-port 1179\n```\n\n2. The multi-agent routing protocol model must be in use:\n\n```\nswitch>show running-config all | inc service routing protocols\nservice routing protocols model multi-agent\n```\n\nIf either of the above outputs are missing there is no exposure. There is no ACL protection that drops incoming TCP connections from unexpected remote IP addresses which makes DOS attacks more effective. If Generalized TTL Security Mechanism (GTSM) is configured, the GTSM rules that implement TTL checks are rendered ineffective.",
          "title": "1977472: Required Config for Exploitation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-7"
        ],
        "fixed": [
          "CSAFPID-0",
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "MITRE",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121290"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.33.11",
          "product_ids": [
            "CSAFPID-0"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.34.9",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.35.7",
          "product_ids": [
            "CSAFPID-2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.3",
          "product_ids": [
            "CSAFPID-4"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.37.0",
          "product_ids": [
            "CSAFPID-3"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 1.0.0",
          "product_ids": [
            "CSAFPID-7"
          ]
        },
        {
          "category": "mitigation",
          "details": "If operationally feasible, removing the non-default listen port configuration allows protecting to be effective on the default BGP port (179):\n\n```\nrouter bgp <asn>\n   no bgp transport listen-port\n```\n\nIf the non-default listen port must be retained, the required modifications to the control plane ACL (to allow the non-default listen port to be reached) should be made in such a manner to provide the desired protection -- only allowing TCP connections using the non-default listen port when the remote IP address in an expected one, and if applicable, when the TTL value is within the expected range."
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-0",
            "CSAFPID-3",
            "CSAFPID-7",
            "CSAFPID-2",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-121290"
    }
  ]
}