Arista EOS: Denial of service via crafted S-BFD PDU
Summary
Arista EOS devices configured as S-BFD initiators can be crashed by a crafted S-BFD PDU sent by an unauthenticated remote attacker. The kernel crash causes an unexpected reboot of the device, which interrupts routing or switching. According to the CVE record, the flaw applies only when the initiator has round-trip delay measurement enabled. The CVSS 4.0 score of 9.2 comes from the supplied data and has not yet been verified against the vendor advisory.
Affected
- Arista EOS 4.36.0F to 4.36.2F
- Arista EOS 4.35.0F to 4.35.6M
- Arista EOS 4.34.0F to 4.34.8M
- Arista EOS 4.33.0F to 4.33.10M
- Arista EOS 4.32.0F to before 4.33.0F
- Arista EOS 1.0.0 to before 4.32.0F
- Only with S-BFD initiator configured: initiator measurement delay round-trip
- Default configuration is unaffected (per CVE record)
Fixed in
Unknown.
Workaround
- Unknown. The vendor mitigation text could not be verified.
Exploitation
- No known exploitation in the wild and no public proof of concept at the time of writing.
Our recommendation
- Check whether Arista EOS devices are in use and whether an S-BFD initiator with round-trip delay measurement is configured.
- Restrict BFD and S-BFD traffic to trusted peers and block it from untrusted networks.
- Obtain the Arista advisory and apply the corrected EOS release once its fixed versions are confirmed.
- Monitor for unexpected reboots and watch the NVD record for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0223 www.arista.com
- Arista advisories and notices www.arista.com
- Arista EOS manual: Bidirectional Forwarding Detection www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:23.
Original description (NVD)
On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.