Arista EOS: NULL pointer dereference in BGP DPS address family processing
Summary
A flaw in Arista EOS allows an attacker who controls a BGP peer to send a crafted BGP message over an established session where the Dynamic Path Selection (DPS) address family is negotiated. The BGP process terminates unexpectedly, resetting all BGP sessions and interrupting routing until the process restarts. Exploitation requires an existing BGP session and a configured DPS address family, so the flaw is not reachable from the internet by default.
Affected
- Arista EOS 1.0.0 to before 4.33.0F
- Arista EOS 4.33.0F to 4.33.10M
- Arista EOS 4.34.0F to 4.34.8M
- Arista EOS 4.35.0F to 4.35.6M
- Arista EOS 4.36.0F to 4.36.2F
- Only relevant where the DPS address family is negotiated in BGP. Default configuration is unaffected.
Fixed in
Unknown. The vendor advisory 25032-0210 was not verified; do not assume the upper bounds of the ranges are fixed releases.
Workaround
Unknown. Check Arista advisory 25032-0210 for interim measures before applying any mitigation.
Exploitation
- CISA KEV: not listed
- Public proof of concept: none found
- Exploited in the wild: nothing found
- Vendor statements: not available
Our recommendation
- Inventory Arista EOS devices and compare versions with the affected ranges.
- Check with show running-config whether BGP is used and whether the DPS address family is negotiated.
- Restrict BGP peering to known, trusted neighbours.
- Obtain advisory 25032-0210, confirm the fixed release and mitigations, and plan the upgrade.
- Recheck NVD once its analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0210 www.arista.com
- CVE Record CVE-2026-121293 www.cve.org
- Strix CVE-2026-121293 www.strix.ai
- Strix CVE-2026-120978 (related BGP-LS/DPS issue) www.strix.ai
- Arista EOS BGP documentation www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:57.
Original description (NVD)
On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.