Arista EOS: Denial of service via Precision Time Protocol

Summary

Arista EOS devices with Precision Time Protocol (PTP) configured are affected. An unauthenticated attacker with network access to a PTP-enabled port can send traffic to the system and cause a denial of service. The attack requires network access to the PTP port, not internet access.

Affected

• Arista EOS 4.34.0F to 4.34.1F
• Arista EOS 4.33.0F to 4.33.8M
• Arista EOS 4.32.0F to before 4.33.0F
• Arista EOS 4.31.0F to before 4.32.0F
• Arista EOS 4.30.0F to before 4.31.0F
• Arista EOS 4.29.2F to before 4.30.0F
• Only systems with PTP configured are affected; other configurations are not affected according to the CVE record.

Fixed in

Unknown. The vendor advisory was not verifiable at the time of writing; check the Arista advisory for fixed releases.

Workaround

• Per the CVE record, a vendor workaround exists: set the MMU_MAX_BUCKET_QLAYER and MMU_MIN_BUCKET_QLAYER diagnostic parameters on Trident linecards (commands listed in the advisory).
• Disable PTP on affected interfaces before applying the commands ('no ptp enable'), then re-enable it afterwards.
• The settings are not persistent and must be re-applied after a forwarding plane reset or linecard replacement.

Exploitation

Unknown. No reports of exploitation in the wild or public proof of concept were found. NVD has not yet analysed the CVE.

Our recommendation

• Check whether PTP is enabled on any Arista EOS switch (show ptp).
• If PTP is not needed, disable it.
• If PTP is needed, restrict PTP traffic to trusted ports and segments and apply the vendor workaround.
• Apply the vendor fix once the advisory confirms fixed versions.
• Monitor the Arista advisories page for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Arista Security Advisory 0224 (CVE-2026-121370) www.arista.com
• Arista Security Advisories index www.arista.com
• Arista Security Advisory 0076 (PTP, related but different CVE) www.arista.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:23.