CVE-2026-120980 - Vulnerability Details - OpenCVE

On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214

History

Tue, 10 Nov 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly.
Title		Security Advisory 0214
Weaknesses		CWE-617
References		https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Arista

Published: 2026-11-10T20:09:53.555Z

Updated: 2026-11-10T20:09:53.555Z

Reserved: 2026-11-03T05:14:06.127Z

Link: CVE-2026-120980

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-10T20:18:53.217

Modified: 2026-11-10T20:18:53.217

Link: CVE-2026-120980

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-617

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120980", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-11-03T05:14:06.127Z", "datePublished": "2026-11-10T20:09:53.555Z", "dateUpdated": "2026-11-10T20:09:53.555Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-11-10T20:09:53.555Z"}, "title": "Security Advisory 0214", "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly."}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "defaultStatus": "unaffected", "versions": [{"version": "4.33.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.33.10M"}, {"version": "4.34.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.34.8M"}, {"version": "4.35.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.35.6M"}, {"version": "4.36.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.36.2F"}], "platforms": ["7280R3 Series", "7500R3 Series", "7800R3 Series"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "baseScore": 6, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214", "tags": ["vendor-advisory"]}], "source": {"defects": ["1925240"], "advisory": "Security Advisory 0214", "discovery": "INTERNAL"}, "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617 Reachable Assertion"}]}], "configurations": [{"lang": "en", "value": "switch>show bgp vpls signaling \nVPLS instance: CUSTOMER_1, group: BGP_MESH_1\nRoute distinguisher: 10.1.1.1:42\nRoute target to import: Route-Target-AS:65534:100\nRoute target to export: Route-Target-AS:65534:100\nLocal VE-ID: 1\nRemote VE-ID: 2, address: 10.2.2.2, encap label: 116384, decap label: 136385\nRemote VE-ID: 3, address: 10.3.3.3, encap label: 116385, decap label: 136386", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<pre>switch>show bgp vpls signaling \nVPLS instance: CUSTOMER_1, group: BGP_MESH_1\nRoute distinguisher: 10.1.1.1:42\nRoute target to import: Route-Target-AS:65534:100\nRoute target to export: Route-Target-AS:65534:100\nLocal VE-ID: 1\nRemote VE-ID: 2, address: 10.2.2.2, encap label: 116384, decap label: 136385\nRemote VE-ID: 3, address: 10.3.3.3, encap label: 116385, decap label: 136386</pre>"}]}], "impacts": [{"capecId": "CAPEC-230", "descriptions": [{"lang": "en", "value": "CAPEC-230 Serialized Data with Nested Payloads"}]}]}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["7280R3 Series", "7500R3 Series", "7800R3 Series"], "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.33.10M", "status": "affected", "version": "4.33.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.34.8M", "status": "affected", "version": "4.34.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.35.6M", "status": "affected", "version": "4.35.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.36.2F", "status": "affected", "version": "4.36.0F", "versionType": "custom"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly."}], "id": "CVE-2026-120980", "lastModified": "2026-11-10T20:18:53.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-11-10T20:18:53.217", "references": [{"source": "[email protected]", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "[email protected]", "type": "Secondary"}]}