CVE-2026-121367

Summary

A flaw in Arista EOS causes RIPv2 to be silently enabled on management interfaces despite being configured as disabled, allowing unauthenticated attackers to inject malicious routes via adjacent network access. This violates expected security boundaries and enables traffic redirection or blackholing without authentication.

Exploitability

Exploitation requires an unauthenticated attacker with network access to the same broadcast or subnet as the device's management interface; no authentication or user interaction is needed.

Blast radius

Successful exploitation allows attackers to manipulate routing tables, potentially redirecting or dropping traffic passing through the affected device, leading to loss of connectivity or man-in-the-middle capabilities for downstream systems.

Detection

Monitor for unexpected RIPv2 advertisements received on management interface IP addresses via network traffic analysis; also check for new or unauthorized routes installed in the routing table originating from untrusted adjacent networks. No host-side logs or file artefacts are reliably generated by this flaw.

Prioritized remediation

Disable RIPv2 on all interfaces, especially management interfaces, until the device is upgraded to Arista EOS version 4.27.3F, 4.28.2F, 4.29.1F, or later (per vendor advisory); refer to Arista Security Advisory ASA-2026-0001 for exact fixed versions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.