Arista EOS: Denial of service and possible code execution in RIP agent

Summary

A flaw in the RIPv2 agent of Arista EOS can be triggered by crafted RIPv2 packets, causing the RIP agent to crash. An unauthenticated attacker on an adjacent network segment can exploit this against a RIP-enabled interface without valid credentials. Repeated exploitation reliably interrupts routing on the affected device and may disrupt devices that depend on it; the advisory names arbitrary code execution as a worst case.

Affected

• Arista Networks EOS 4.37.0F
• Arista Networks EOS 4.36.0F to 4.36.2F
• Arista Networks EOS 4.35.0F to 4.35.6M
• Arista Networks EOS 4.34.0F to 4.34.8M
• Arista Networks EOS 4.33.0F to 4.33.10M
• Arista Networks EOS 4.32.0F before 4.33.0F
• Arista Networks EOS 1.0.0 before 4.32.0F
• Default configuration: unaffected. Only devices with RIP enabled are relevant.

Fixed in

Unknown. The vendor advisory's Resolution section must be checked for fixed releases.

Workaround

• Disable RIP where it is not needed: router rip / shutdown.
• Restrict RIP to trusted interfaces and limit which Layer 2 segments can reach RIP-enabled ports.
• Do not rely on RIPv2 MD5 authentication alone, as the related CVE-2026-121288 reportedly allows bypass (third-party information, not confirmed by Arista).
• Note: disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window and verify routes afterwards.

Exploitation

• No exploitation in the wild known at the time of writing.
• No public proof of concept found.
• No CISA KEV entry.

Our recommendation

• Check whether Arista EOS devices are in use and whether RIP is enabled (show running-config | section router rip).
• If RIP is enabled, plan a change window and apply the fixed release from Arista's advisory once confirmed.
• Until then, disable RIP where not required and restrict RIP to trusted interfaces.
• Monitor for routing instability and unusual RIP traffic on adjacent segments.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Arista Security Advisory 0221 www.arista.com
• CVE Record CVE-2026-121287 www.cve.org
• NVD Analysis Status (secondary aggregator) www.strix.ai
• Strix: CVE-2026-121288 (related MD5 bypass, third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:46.