{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 212 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212" } ], "title": "Security Advisory 212", "tracking": { "current_release_date": "2026-11-08T09:58:22Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 212", "initial_release_date": "2026-11-08T09:58:22Z", "revision_history": [ { "date": "2026-11-08T09:58:22Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.35.7", "product": { "name": "EOS version 4.35.7", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 1.0.0", "product": { "name": "EOS version 1.0.0", "product_id": "CSAFPID-3" } }, { "category": "product_version", "name": "EOS version 4.36.3", "product": { "name": "EOS version 4.36.3", "product_id": "CSAFPID-0" } }, { "category": "product_version", "name": "EOS version 4.33.11", "product": { "name": "EOS version 4.33.11", "product_id": "CSAFPID-1" } }, { "category": "product_version", "name": "EOS version 4.37.0", "product": { "name": "EOS version 4.37.0", "product_id": "CSAFPID-2" } }, { "category": "product_version", "name": "EOS version 4.34.9", "product": { "name": "EOS version 4.34.9", "product_id": "CSAFPID-4" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-120979", "id": { "system_name": "Arista Bug ID", "text": "2059581" }, "notes": [ { "category": "description", "text": "This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding.", "title": "CVE Description" }, { "category": "other", "text": "In order to be vulnerable, BGP-LS must be configured, at least one BGP-LS peer session must be established, and the device must be configured as a Pathfinder node.\n\n1. BGP-LS configured with a peer session established:\n\n```\nswitch(config)#show bgp link-state summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State NlriRcd NlriAcc NlriAdv\n 12.0.0.3 4 300 82 83 0 0 01:02:33 Estab 0 0 1\nswitch(config)#\n```\n\nAnd\n\n2. The device is configured as a Pathfinder node:\n\n```python\nswitch#show adaptive-virtual-topology path | section Role:\nRole: pathfinder\n```\n\n##### Not Affected:\n\nIf BGP-LS is not configured or no peers are established, the device is not vulnerable.\n\nIf any one of these steps match, then the device is NOT affected.\n\na. BGP link-state is not configured.\n\n```\nswitch(config-router-bgp)#show bgp link-state summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State NlriRcd NlriAcc NlriAdv\nswitch(config-router-bgp)#\n```\n\nb. The device is not configured in the Pathfinder role.\n\n```python\nswitch#show adaptive-virtual-topology path | section Role:\nRole: edge\n\nswitch#show adaptive-virtual-topology path | section Role:\nRole: zone transit\n\nswitch#show adaptive-virtual-topology path | section Role:\nRole: region transit\n\nswitch#show adaptive-virtual-topology path | section Role:\nRole: unknown\n```", "title": "2059581: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-3" ], "fixed": [ "CSAFPID-0", "CSAFPID-1", "CSAFPID-2", "CSAFPID-4", "CSAFPID-5" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-120979" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.11", "product_ids": [ "CSAFPID-1" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.9", "product_ids": [ "CSAFPID-4" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.7", "product_ids": [ "CSAFPID-5" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.3", "product_ids": [ "CSAFPID-0" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.37.0", "product_ids": [ "CSAFPID-2" ] }, { "category": "none_available", "details": "Not fixed in EOS version 1.0.0", "product_ids": [ "CSAFPID-3" ] }, { "category": "mitigation", "details": "There are no configuration-level mitigations that fully resolve this issue without upgrading software." } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0", "CSAFPID-4", "CSAFPID-1", "CSAFPID-2", "CSAFPID-3", "CSAFPID-5" ] } ], "title": "CVE-2026-120979" } ] }