{
  "document": {
    "category": "security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "contact_details": "support@arista.com",
      "name": "Arista PSIRT",
      "namespace": "https://www.arista.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Security advisory 220 canonical URL",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220"
      }
    ],
    "title": "Security Advisory 220",
    "tracking": {
      "current_release_date": "2026-11-08T09:58:21Z",
      "generator": {
        "engine": {
          "name": "Arista Networks SecEng Service CSAF Generator"
        }
      },
      "id": "Arista Networks Security Advisory 220",
      "initial_release_date": "2026-11-08T09:58:21Z",
      "revision_history": [
        {
          "date": "2026-11-08T09:58:21Z",
          "number": "1",
          "summary": "Document created"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "EOS version 1.0.0",
                    "product": {
                      "name": "EOS version 1.0.0",
                      "product_id": "CSAFPID-5"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.34.9",
                    "product": {
                      "name": "EOS version 4.34.9",
                      "product_id": "CSAFPID-2"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.35.7",
                    "product": {
                      "name": "EOS version 4.35.7",
                      "product_id": "CSAFPID-3"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.36.3",
                    "product": {
                      "name": "EOS version 4.36.3",
                      "product_id": "CSAFPID-4"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.33.11",
                    "product": {
                      "name": "EOS version 4.33.11",
                      "product_id": "CSAFPID-1"
                    }
                  }
                ],
                "category": "product_name",
                "name": "EOS"
              }
            ],
            "category": "product_family",
            "name": "Software Products"
          }
        ],
        "category": "vendor",
        "name": "Arista Networks, Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-121367",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "1981966"
      },
      "notes": [
        {
          "category": "description",
          "text": "On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication.\n\nSuccessful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device.",
          "title": "CVE Description"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-121367, the following conditions must both be met:\n\n* RIP is enabled\n* RIP network configuration matches the subnet assigned to the management interface in the same VRF\n\nRIP processing on the management interface may not appear in running configuration,\n\nso routine configuration review may not reveal the exposure.\n\n```\nswitch# show running-config section router rip\nrouter rip\n   network 10.252.36.128/25\n   no shutdown\n\nswitch# show running-config section interface Management1\ninterface Management1\n   ip address 10.252.36.194/25\n```",
          "title": "1981966: Required Config for Exploitation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-5"
        ],
        "fixed": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "MITRE",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121367"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.33.11",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.34.9",
          "product_ids": [
            "CSAFPID-2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.35.7",
          "product_ids": [
            "CSAFPID-3"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.3",
          "product_ids": [
            "CSAFPID-4"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 1.0.0",
          "product_ids": [
            "CSAFPID-5"
          ]
        },
        {
          "category": "mitigation",
          "details": "In environments where RIP is not required, it should be disabled within each affected VRF instance. Please note that disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior.\n\nThe following example disables the default-VRF RIP instance:\n\n```\nswitch# configure terminal\nswitch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n```\n\nIf RIP is necessary on data interfaces but not on the management subnet, verify that no RIP network prefix matches that management subnet. The specific configuration details are delineated in the above Required Configuration for Exploitation section."
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-5",
            "CSAFPID-3",
            "CSAFPID-2",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-121367"
    }
  ]
}