Vulnerability in Arista Networks Eos
CVE-2026-121367
On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication. Successful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device.
Published .
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Arista Networks Eos — versions 4.37.0F
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-121367?
- CVE-2026-121367 is a critical-severity vulnerability in Arista Networks Eos, classified under Expected Behavior Violation. CVSS score: 9.6/10. Published 2026-11-10.
- How severe is CVE-2026-121367?
- Critical severity. CVSS v3 base score is 9.6 out of 10.