Arista EOS: Route injection via RIPv2 on management interfaces
Summary
On Arista EOS devices with RIPv2 configured, RIPv2 may be silently enabled on management interfaces even when the RIP agent is meant to disable it. An unauthenticated attacker on the adjacent network can send crafted RIPv2 route advertisements to the management IP, and the device may accept and install them. This can redirect traffic, install blackhole routes, or disrupt reachability for systems whose traffic passes through the device.
Affected
- Arista EOS 1.0.0 to < 4.33.0F (conflicting sources; verify in the advisory)
- Arista EOS 4.33.0F to <= 4.33.10M
- Arista EOS 4.34.0F to <= 4.34.8M
- Arista EOS 4.35.0F to <= 4.35.6M
- Arista EOS 4.36.0F to <= 4.36.2F
- Arista EOS 4.37.0F is unaffected by default
- Only devices with RIPv2 configured are affected under certain conditions
Fixed in
Unknown.
Workaround
- Disable RIP in each affected VRF: router rip, shutdown
- If RIP is needed on data interfaces, verify that no RIP network prefix matches the management subnet
- Restrict access to management IPs with ACLs or a dedicated management network
Exploitation
- No known exploitation found; not listed in CISA KEV at time of research
- No public proof of concept found in the search; this does not prove that none exists
Our recommendation
- Check whether RIP is configured on EOS devices (show running-config section router rip)
- Check whether RIP prefixes overlap the management subnet
- If RIP is not needed, disable it
- Restrict management access to trusted segments
- Check the Arista advisory for fixed releases and apply them
- Review Arista advisory 0221 and CVE-2026-121287 together if RIPv2 is in use
- Monitor routing tables for unexpected routes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista security advisory 0220 www.arista.com
- Advisory mirror ARISTA:0220 vulners.com
- Advisory 0221 mirror vulners.com
- CVE record mirror CVE-2026-121367 cve.threatint.com
- Strix CVE page CVE-2026-121367 www.strix.ai
- Arista vulnerability management process www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:16.
Original description (NVD)
On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication. Successful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.