CVE-2026-121288
Last modified
CVE-2026-121288 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | EOS | 4.37.0F; >= 4.36.0F, <= 4.36.2F; >= 4.35.0F, <= 4.35.6M; >= 4.34.0F, <= 4.34.8M; >= 4.33.0F, <= 4.33.10M; >= 4.32.0F, < 4.33.0F; >= 1.0.0, < 4.32.0F |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-121288?
How severe is CVE-2026-121288?
How do I fix CVE-2026-121288?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121265SQL::Abstract versions before 2.000003 for Perl allow SQL in…9.8
- CVE-2026-121267Incorrect default permissions vulnerability in TÜBİTAK BİLGE…7.8
- CVE-2026-12127The WPForms – Easy Form Builder for WordPress – Contact Form…5.3
- CVE-2026-12128The Pinpoint Booking System – Version 2 plugin for WordPress…5.3
- CVE-2026-121286On affected platforms running Arista EOS in multi-agent rout…6.5
- CVE-2026-121287An unauthenticated attacker on an adjacent network segment c…8.8
- CVE-2026-121289On affected platforms running Arista EOS with BGP configured…9.8
- CVE-2026-12129A vulnerability was identified in CodeAstro Human Resource M…3.5
- CVE-2026-121290On affected platforms running Arista EOS with Border Gateway…8.2
- CVE-2026-121291A crafted Error Report can leave EOS stuck believing that a …8.2
- CVE-2026-121292A malformed Error Report can cause EOS to read beyond packet…8.2
- CVE-2026-121293On affected EOS-based platforms, an attacker who controls a …4.4
Are you affected by CVE-2026-121288?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST