{
  "document": {
    "category": "security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "contact_details": "support@arista.com",
      "name": "Arista PSIRT",
      "namespace": "https://www.arista.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Security advisory 221 canonical URL",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"
      }
    ],
    "title": "Security Advisory 221",
    "tracking": {
      "current_release_date": "2026-11-08T09:58:22Z",
      "generator": {
        "engine": {
          "name": "Arista Networks SecEng Service CSAF Generator"
        }
      },
      "id": "Arista Networks Security Advisory 221",
      "initial_release_date": "2026-11-08T09:58:22Z",
      "revision_history": [
        {
          "date": "2026-11-08T09:58:22Z",
          "number": "1",
          "summary": "Document created"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "EOS version 4.34.9",
                    "product": {
                      "name": "EOS version 4.34.9",
                      "product_id": "CSAFPID-2"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.35.7",
                    "product": {
                      "name": "EOS version 4.35.7",
                      "product_id": "CSAFPID-3"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.36.3",
                    "product": {
                      "name": "EOS version 4.36.3",
                      "product_id": "CSAFPID-4"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.33.11",
                    "product": {
                      "name": "EOS version 4.33.11",
                      "product_id": "CSAFPID-1"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.24.2",
                    "product": {
                      "name": "EOS version 4.24.2",
                      "product_id": "CSAFPID-6"
                    }
                  }
                ],
                "category": "product_name",
                "name": "EOS"
              }
            ],
            "category": "product_family",
            "name": "Software Products"
          }
        ],
        "category": "vendor",
        "name": "Arista Networks, Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-121287",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "1981970"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device.",
          "title": "CVE Description"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-121287, the following three conditions must be met:\n\n* RIP is enabled\n* MD5 authentication configured on an interface\n* RIP network configuration must match the interface ip-address\n\n```\nswitch# show running-config | section router rip\nrouter rip\n   no shutdown\n   network 192.0.2.0/24\n\nswitch# show running-config interfaces Ethernet1\ninterface Ethernet1\n   ip address 192.0.2.1/24 \n   rip authentication algorithm md5 tx key-id 10\n```",
          "title": "1981970: Required Config for Exploitation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-6"
        ],
        "fixed": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "MITRE",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121287"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.33.11",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.34.9",
          "product_ids": [
            "CSAFPID-2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.35.7",
          "product_ids": [
            "CSAFPID-3"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.3",
          "product_ids": [
            "CSAFPID-4"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 4.24.2",
          "product_ids": [
            "CSAFPID-6"
          ]
        },
        {
          "category": "mitigation",
          "details": "In environments where RIP is not required, it should be disabled within each affected VRF instance. Please note that disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior.\n\nThe following example disables the default-VRF RIP instance:\n\n```\nswitch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n```"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-3",
            "CSAFPID-6",
            "CSAFPID-2",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-121287"
    },
    {
      "cve": "CVE-2026-121288",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "1985547"
      },
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity.",
          "title": "CVE Description"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-121288, the following three conditions must be met:\n\n* RIP is enabled\n* MD5 authentication configured on an interface\n* RIP network configuration must match the interface ip-address\n\n```\nswitch# show running-config | section router rip\nrouter rip\n   no shutdown\n   network 192.0.2.0/24\n\nswitch# show running-config interfaces Ethernet1\ninterface Ethernet1\n   ip address 192.0.2.1/24 \n   rip authentication algorithm md5 tx key-id 10\n```",
          "title": "1985547: Required Config for Exploitation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-6"
        ],
        "fixed": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "MITRE",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121288"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.33.11",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.34.9",
          "product_ids": [
            "CSAFPID-2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.35.7",
          "product_ids": [
            "CSAFPID-3"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.3",
          "product_ids": [
            "CSAFPID-4"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 4.24.2",
          "product_ids": [
            "CSAFPID-6"
          ]
        },
        {
          "category": "mitigation",
          "details": "In environments where RIP is not required, it should be disabled within each affected VRF instance. Please note that disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior.\n\nThe following example disables the default-VRF RIP instance:\n\n```\nswitch(config)# router rip\nswitch(config-router-rip)# shutdown\nswitch(config-router-rip)# end\n```"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-3",
            "CSAFPID-6",
            "CSAFPID-2",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-121288"
    }
  ]
}