Arista EOS: Unprotected BGP listener when non-default listen port is used

Summary

When Border Gateway Protocol (BGP) runs on affected Arista EOS devices and the BGP listen port has been changed from its default value, the default protective Access Control List (ACL) rules against unexpected BGP peering attempts are disabled. An attacker who can reach the BGP listener over the network can attempt unauthorised BGP sessions, which the CVSS vector rates as low integrity and high availability impact without confidentiality impact. No authentication is required according to the vector.

Affected

• Arista EOS 4.36.0F to 4.36.2F (status of 4.36.x to be confirmed against the advisory, as sources conflict)
• Arista EOS 4.35.0F to 4.35.6M
• Arista EOS 4.34.0F to 4.34.8M
• Arista EOS 4.33.0F to 4.33.10M
• Arista EOS 4.32.0F to before 4.33.0F
• Arista EOS 1.0.0 to before 4.32.0F
• Only affected when the BGP listen port differs from the default (179)

Fixed in

Unknown. No confirmed fixed release was found in the sources; check the Arista advisory.

Workaround

• Return the BGP listen port to its default by running "no bgp transport listen-port" under "router bgp <asn>".
• If a non-default port must be kept, restrict the control plane ACL so that only expected remote IP addresses (and, where applicable, expected TTL values) can reach that port.
• Check the configuration with "show running-config section bgp | include listen-port".
• Test any ACL on the affected platform before relying on it, as a researcher reported that cEOS may not apply inbound control-plane ACLs.

Exploitation

No evidence found of exploitation in the wild, public proof of concept, or CISA KEV listing at the time of research. The record is recent, so this may change quickly.

Our recommendation

• Inventory all Arista EOS devices and compare their versions with the affected ranges; confirm the status of 4.36.x in the Arista advisory.
• Check whether any BGP listen port differs from 179 and, if so, revert it to the default or restrict access with ACLs.
• Check whether BGP is reachable from untrusted networks and restrict it at the network edge.
• Plan the upgrade to a fixed release once confirmed by Arista.
• Re-check CISA KEV and NVD over the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Arista Security Advisory 0209 www.arista.com
• Arista EOS BGP documentation www.arista.com
• Arista EOS ACLs and route maps documentation www.arista.com
• CVE-2026-121290 at Strix www.strix.ai
• CVE-2026-121290 at threatint cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:21.