{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-121289",
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"state": "PUBLISHED",
"assignerShortName": "Arista",
"dateReserved": "2026-11-03T11:21:01.892Z",
"datePublished": "2026-11-10T20:09:56.814Z",
"dateUpdated": "2026-11-10T20:09:56.814Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista",
"dateUpdated": "2026-11-10T20:09:56.814Z"
},
"title": "Security Advisory 0208",
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.\n\nSuccessful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system."
}
],
"affected": [
{
"vendor": "Arista Networks",
"product": "EOS",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.36.0F",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "4.36.2F"
},
{
"version": "4.35.0F",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "4.35.6M"
},
{
"version": "4.34.0F",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "4.34.8M"
},
{
"version": "4.33.0F",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "4.33.10M"
},
{
"version": "4.25.1F",
"status": "affected",
"versionType": "custom",
"lessThan": "4.33.0F"
}
],
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6/XE7 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"ZTX-7200 Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
}
},
{
"cvssV4_0": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"baseScore": 9.3,
"baseSeverity": "CRITICAL"
}
}
],
"references": [
{
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208",
"tags": [
"vendor-advisory"
]
}
],
"source": {
"defects": [
"1927959"
],
"advisory": "Security Advisory 0208",
"discovery": "EXTERNAL"
},
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"type": "CWE",
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "switch>show ip bgp summary\nBGP summary information for VRF default\nRouter identifier 10.0.0.1, local AS number 65000\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\n 10.0.0.2 4 65001 100 100 0 0 01:00:00 Estab 10 10\n\nswitch>show running-config all | inc service routing protocols\nservice routing protocols model multi-agent",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "switch>show ip bgp summary\nBGP summary information for VRF default\nRouter identifier 10.0.0.1, local AS number 65000\nNeighbor Status Codes: m - Under maintenance\n Neighbor V AS MsgRcvd MsgSent InQ OutQ Up/Down State PfxRcd PfxAcc\n 10.0.0.2 4 65001 100 100 0 0 01:00:00 Estab 10 10\n\nswitch>show running-config all | inc service routing protocols\nservice routing protocols model multi-agent
"
}
]
}
],
"workarounds": [
{
"lang": "en",
"value": "For BGP sessions that do not rely on the Tunnel Encapsulation Attribute, a workaround is to remove all received Tunnel Encapsulation Attributes by configuring attribute discard, for example:\n\nneighbor default received attribute discard 23\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using TCP-AO in order to ensure that only authorized peers can establish a BGP session.",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For BGP sessions that do not rely on the Tunnel Encapsulation Attribute, a workaround is to remove all received Tunnel Encapsulation Attributes by configuring attribute discard, for example:\n\nneighbor default received attribute discard 23\n\nAlternatively, a recommended mitigation to reduce exposure to this vulnerability is to configure BGP peer authentication using TCP-AO in order to ensure that only authorized peers can establish a BGP session.
"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported to Arista by Joshua Foote of JP Morgan Chase.",
"type": "reporter"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
]
}
}
}