{"id":"CVE-2026-121367","published":"2026-11-10T20:18:55.933","lastModified":"2026-11-10T20:18:55.933","description":"On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication.\n\nSuccessful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","cwes":["CWE-440"],"vendors":[],"products":[],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A flaw in Arista EOS causes RIPv2 to be silently enabled on management interfaces despite being configured as disabled, allowing unauthenticated attackers to inject malicious routes via adjacent network access. This violates expected security boundaries and enables traffic redirection or blackholing without authentication.","exploitability":"Exploitation requires an unauthenticated attacker with network access to the same broadcast or subnet as the device's management interface; no authentication or user interaction is needed.","blast_radius":"Successful exploitation allows attackers to manipulate routing tables, potentially redirecting or dropping traffic passing through the affected device, leading to loss of connectivity or man-in-the-middle capabilities for downstream systems.","remediation":"Disable RIPv2 on all interfaces, especially management interfaces, until the device is upgraded to Arista EOS version 4.27.3F, 4.28.2F, 4.29.1F, or later (per vendor advisory); refer to Arista Security Advisory ASA-2026-0001 for exact fixed versions.","detection":"Monitor for unexpected RIPv2 advertisements received on management interface IP addresses via network traffic analysis; also check for new or unauthorized routes installed in the routing table originating from untrusted adjacent networks. No host-side logs or file artefacts are reliably generated by this flaw.","tags":["routing-protocol-exploit","auth-bypass","traffic-redirection","management-interface-exposure"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:55:39.061Z"}}