Arista EOS BGP: changing the listen port silently drops the default protective ACL

CVSS 8.3CVE-2026-121290Firmware, BMC & network fabriccurated

Impact

On affected switches, moving the BGP listen port off its default value turns off the built-in ACL rules that block unexpected BGP peering attempts. Unsolicited peers can then reach the BGP process, which leaves the switch open to routing disruption. A GPU fabric that runs BGP would lose cluster connectivity. Only switches configured with a non-default BGP listen port are affected. The record does not list versions.

Who can reach it

Anyone on the network who can reach the switch's non-default BGP listen port. No authentication needed to reach it. The flaw only exists when an operator has changed the BGP listen port.

What to do

Check whether any switches run BGP on a non-default listen port. If so, upgrade EOS to a fixed release from Arista Security Advisory 0209, which requires a switch reload. In the meantime, add explicit control-plane ACLs that allow only known BGP neighbors, or go back to the default port.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121290 https://www.arista.com/en/support/advisories-notices/security-advisory/25031-security-advisory-0209

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.