On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s). The vulnerability is associated with CWE‑303, indicating an improper limitation or control condition, which can degrade network availability and reliability for all users of the affected network devices.

Arista Networks EOS firmware versions are impacted. The following releases contain the fix: 4.36.2F and later within the 4.36.x train, 4.35.6M and later within the 4.35.x train, 4.34.8M and later within the 4.34.x train, and 4.33.9M and later within the 4.33.x train. Devices running any earlier versions of these firmware trains are vulnerable.

The CVSS score of 9.2 classifies this flaw as Critical. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the lack of known public exploitation and absence from KEV suggest exploitation risk is not yet widespread. The likely attack vector involves the network, where an attacker capable of sending crafted BFD packets—either through local network access, compromised BFD peers, or devices with exposed BFD interfaces—could trigger session failures. The vulnerability requires authenticated BFD sessions to be present; without them, the flaw has no effect.