Arista EOS: RIPv2 MD5 authentication bypass allows unauthorized route updates
Summary
Arista EOS on affected switches and routers accepts RIPv2 route updates without valid MD5 authentication when RIPv2 MD5 is configured on an interface. An unauthenticated attacker on an adjacent network segment who injects crafted RIPv2 packets can cause malicious routes to be installed, redirecting, looping or blackholing traffic. The attack requires adjacent network access and a RIPv2 MD5 configuration on the affected interface; the device is not directly reachable from the internet.
Affected
- Arista Networks EOS 4.37.0F (status disputed between sources; verify with the vendor advisory)
- EOS 4.36.0F to 4.36.2F
- EOS 4.35.0F to 4.35.6M
- EOS 4.34.0F to 4.34.8M
- EOS 4.33.0F to 4.33.10M
- EOS 4.32.0F to before 4.33.0F
- EOS 1.0.0 to before 4.32.0F (listed as affected by some mirrors; verify)
- Only configurations with RIPv2 MD5 authentication on an interface are exploitable.
Fixed in
Unknown. Check the fixed release for each affected EOS branch in Arista Security Advisory 0221.
Workaround
- Disable RIP where it is not required: router rip, shutdown.
- Where RIP is required, limit it to known peer interfaces, make interfaces without peers passive and filter RIP traffic from untrusted segments.
- Do not rely on MD5 alone, as it is considered weak.
- Note: disabling RIP or changing network statements may withdraw routes and interrupt connectivity. Plan a change window and verify routing afterwards.
Exploitation
Nothing known. No reports of in-the-wild exploitation, no CISA KEV listing and no public proof of concept were found at the time of writing.
Our recommendation
- Check whether RIPv2 with MD5 authentication is configured on any interface (show running-config | section router rip; show running-config interfaces).
- If it is not, the device is not exposed through this path; record the result.
- If it is, obtain the fixed version from the Arista advisory and plan the upgrade within a change window.
- Apply the interim mitigations above and restrict RIP to trusted peers.
- Re-check the exploitation status over the coming days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0221 www.arista.com
- CVE Record CVE-2026-121288 www.cve.org
- Advisory summary (Vulners) vulners.com
- CVE mirror with CVSS and product status cve.threatint.com
- Affected versions and description (Strix) www.strix.ai
- Arista STIG note on MD5 www.stigviewer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:16.
Original description (NVD)
An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.