Arista EOS: crafted RIPv2 packets crash the Rip agent and may allow code execution

CVSS 7.7CVE-2026-121287Firmware, BMC & network fabriccurated

Impact

An attacker on the same network segment sends crafted RIPv2 packets to a RIP-enabled interface and crashes the Rip agent, with no credentials. Repeating the attack keeps routing down on the switch, and any devices that depend on its routes lose them too. Arista says that in the worst case it could allow arbitrary code execution on the switch. Only switches with RIP turned on are exposed, and most GPU fabrics route with BGP or static routes, so check whether any interface runs RIP before treating this as urgent.

Who can reach it

Unauthenticated attacker on a network segment adjacent to a RIP-enabled interface of the switch.

What to do

Follow Arista Security Advisory 0221 for the affected and fixed EOS releases. Upgrading EOS means installing a new image and reloading the switch, so plan to shift traffic away from it first. Where RIP is not needed, turning it off removes the exposure.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121287 https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.