CVE-2026-121289

Summary

A stack-based buffer overflow (CWE-121) in Arista EOS's BGP agent allows remote attackers to crash the BGP process or potentially achieve arbitrary code execution by sending a specially crafted packet over the network. This is critical because BGP session loss disrupts routing and may cascade into broader network outages.

Exploitability

Exploitation requires no authentication or user interaction and can be performed remotely over the network with low complexity, assuming the attacker can reach the BGP port (TCP 179) on the device.

Blast radius

Successful exploitation causes immediate loss of all BGP sessions on the affected device, potentially triggering route instability or blackholing across connected networks until the BGP agent restarts.

Detection

Defenders should monitor for repeated BGP session flaps or unexpected BGP agent process termination events in system logs (e.g., 'bgpd' crash messages or core dumps), especially when accompanied by high-volume or malformed BGP update messages from unauthenticated or unexpected peers. No reliable network-level signature is published.

Prioritized remediation

Upgrade to Arista EOS version 4.28.3F or later, as patched in Arista Security Advisory ASA-2026-0001 (CVE-2026-121289). If upgrading is not immediately feasible, disable BGP on untrusted interfaces and restrict BGP peer access via ACLs to known trusted sources.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.