# CVE-2026-121367: Arista EOS RIPv2 silent enablement on management interfaces

Source: https://junglewise.ai/threats/cve-2026-121367-on-affected-arista-eos-platforms-with-routing-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-121367 · Severity: critical · CVSS 9.6 · Published 2026-11-10

Arista EOS network switches with RIPv2 routing protocol configured can silently enable RIPv2 on their management interfaces despite administrator intent to disable it. An attacker on the adjacent network can send crafted routing advertisements to inject malicious routes, allowing them to redirect network traffic, black-hole legitimate connections, or disrupt overall network reachability for traffic passing through affected devices.

Technologies: [Arista Eos](https://junglewise.ai/threats/technologies/eos). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-121367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121367 being exploited in the wild.

**How severe is CVE-2026-121367?** Critical severity, with a CVSS score of 9.6, published 10 November 2026.

**Which products and versions are affected?** Arista Eos 4.37.0F, 4.36.2F and below in 4.36.x, 4.35.6M and below in 4.35.x, 4.34.8M and below in 4.34.x, 4.33.10M and below in 4.33.x, all 4.32.x, all End of Support releases.

**Is there a fix for CVE-2026-121367?** Yes: fixed in 4.36.3M and later. Until then: Disable RIP within affected VRF instances if not required, ensuring alternate routing is confirmed before making changes. If RIP is needed on data interfaces, verify that no RIP network prefix matches the management subnet by reviewing configuration and testing route behavior.</anigation>
<parameter name="timeline">[
  {"kind": "disclosed", "at": "2026-11-10"}
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121367 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-121367?** Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.36.3M and later

Disable RIP within affected VRF instances if not required, ensuring alternate routing is confirmed before making changes. If RIP is needed on data interfaces, verify that no RIP network prefix matches the management subnet by reviewing configuration and testing route behavior.</anigation>
<parameter name="timeline">[
  {"kind": "disclosed", "at": "2026-11-10"}
]

## Technical details

When RIPv2 is enabled and a RIP network prefix matches a management interface subnet in the same VRF, the protocol may be unexpectedly activated on that management interface even if not explicitly configured there. An unauthenticated, adjacent-network attacker can send crafted RIPv2 route advertisements to the management IP address; the device accepts and installs these routes without authentication, leading to traffic manipulation or blackholing.

## Affected products

- Arista EOS 4.37.0F, 4.36.2F and below in 4.36.x, 4.35.6M and below in 4.35.x, 4.34.8M and below in 4.34.x, 4.33.10M and below in 4.33.x, all 4.32.x, all End of Support releases

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220](https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220)

## Related threats

- [Arista EOS path traversal in eAPI service](https://junglewise.ai/threats/cve-2026-121371-on-affected-eos-versions-with-the-eapi-service-enabled-a)
- [Arista EOS denial of service in PTP](https://junglewise.ai/threats/cve-2026-121370-on-affected-platforms-running-arista-eos-with-precision-time)
- [Arista EOS denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-121369-on-affected-platforms-running-arista-eos-under-specific-link)
- [Arista EOS BFD authentication out-of-bounds write](https://junglewise.ai/threats/cve-2026-121368-on-affected-platforms-running-arista-eos-with-bidirectional)
- [Arista EOS kernel crash via crafted S-BFD PDU](https://junglewise.ai/threats/cve-2026-121295-on-affected-platforms-running-arista-eos-configured-as-s-bfd)