Arista EOS: Out-of-bounds write in BFD packet processing causes reboot

Summary

Arista EOS on affected platforms is vulnerable when Bidirectional Forwarding Detection (BFD) uses keyed MD5 or keyed SHA1 authentication. An unauthenticated attacker with network adjacency to a BFD-enabled interface can send a specially crafted BFD packet and force a system reboot, causing a denial of service. The CVE record classifies the weakness as CWE-787 (out-of-bounds write).

Affected

• Arista EOS 4.36.0F to 4.36.2F
• Arista EOS 4.35.0F to 4.35.6M
• Arista EOS 4.34.0F to 4.34.8M
• Arista EOS 4.33.0F to 4.33.10M
• Arista EOS 4.32.0F to 4.33.0F (excluding 4.33.0F)
• Arista EOS 1.0.0 to 4.32.0F (excluding 4.32.0F)
• Only configurations with BFD authentication mode md5 or sha1 (standard or meticulous), globally or per interface
• Default configuration (no BFD authentication) is unaffected

Fixed in

Unknown. Check the vendor advisory for fixed versions.

Workaround

Unknown from public sources so far. Check the vendor advisory for an official workaround.

• Restrict BFD control traffic to known peer addresses with ACLs or control-plane policies.
• Verify that the authentication mode is not keyed MD5 or SHA1, if Arista confirms that the meticulous modes are supported on the affected version.

Exploitation

Unknown. No public reports of in-the-wild exploitation or proof-of-concept code were found at the time of writing.

Our recommendation

• Open Arista Security Advisory 0206 and record the affected releases, fixed versions and workarounds.
• Check whether any device runs EOS with BFD and keyed MD5 or SHA1 authentication, and map these devices to the affected versions.
• Plan patching of affected core or data centre switches, and schedule a maintenance window because the impact is a reboot.
• Restrict BFD peers and monitor for unexpected reboots.
• Re-check the CVE status at NVD and the vendor advisory in a few days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Arista Security Advisory 0206 (25028) www.arista.com
• Arista advisories and notices www.arista.com
• IETF draft on BFD authentication analysis www.ietf.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:24.