CVE-2026-121369

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121369", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-11-03T11:27:14.150Z", "datePublished": "2026-11-10T20:10:00.972Z", "dateUpdated": "2026-11-13T16:42:38.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-11-10T20:10:00.972Z"}, "title": "Security Advisory 0225", "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot."}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "defaultStatus": "unaffected", "versions": [{"version": "4.34.2F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.34.7M"}, {"version": "4.35.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.35.6M"}, {"version": "4.36.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.36.1M"}], "platforms": ["750X Series (CCS-750XM-48TX-LC, CCS-750XPM-48NH-LC, CCS-750XPM-48TXH-LC)"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "baseScore": 6.7, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225", "tags": ["vendor-advisory"]}], "source": {"defects": ["1880613"], "advisory": "Security Advisory 0225", "discovery": "INTERNAL"}, "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "configurations": [{"lang": "en", "value": "switch(config-if-Et3/1)#show active all | grep speed\n no speed\n\nswitch(config-if-Et3/2)#show active\ninterface Ethernet3/2\n speed auto", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<pre>switch(config-if-Et3/1)#show active all | grep speed\n no speed\n\nswitch(config-if-Et3/2)#show active\ninterface Ethernet3/2\n speed auto</pre>"}]}], "workarounds": [{"lang": "en", "value": "switch(config)# interface Ethernet3/2\nswitch(config-if-Et3/2)# speed auto 1g\n\n(Workaround: configure an explicit speed on all interfaces to prevent exposure)", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<pre>switch(config)# interface Ethernet3/2\nswitch(config-if-Et3/2)# speed auto 1g\n\n(Workaround: configure an explicit speed on all interfaces to prevent exposure)</pre>"}]}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T16:42:27.455014Z", "id": "CVE-2026-121369", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T16:42:38.757Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["750X Series (CCS-750XM-48TX-LC, CCS-750XPM-48NH-LC, CCS-750XPM-48TXH-LC)"], "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.34.7M", "status": "affected", "version": "4.34.2F", "versionType": "custom"}, {"lessThanOrEqual": "4.35.6M", "status": "affected", "version": "4.35.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.36.1M", "status": "affected", "version": "4.36.0F", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot."}], "id": "CVE-2026-121369", "lastModified": "2026-11-13T17:17:19.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.0, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121369", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-13T16:42:27.455014Z", "version": "2.0.3"}}]}, "published": "2026-11-10T20:18:56.303", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["750x_series_(ccs-750xm-48tx-lc,_ccs-750xpm-48nh-lc,_ccs-750xpm-48txh-lc)"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.34.2F,4.34.7M]"}}, {"platform": ["750x_series_(ccs-750xm-48tx-lc,_ccs-750xpm-48nh-lc,_ccs-750xpm-48txh-lc)"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.35.0F,4.35.6M]"}}, {"platform": ["750x_series_(ccs-750xm-48tx-lc,_ccs-750xpm-48nh-lc,_ccs-750xpm-48txh-lc)"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.36.0F,4.36.1M]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "EOS", "source": "cna", "vendor": "Arista Networks"}, "product": "eos", "vendor": "arista"}], "created": "2026-11-11T23:00:09.384040+00:00", "title": "Arista EOS Denial of Service through Improper Link Speed Configuration", "updated": "2026-11-13T10:15:19.236341+00:00", "vendors": ["arista", "arista$PRODUCT$eos"]}