EUVD-2026-78170
GHSA-x95c-w9r9-rqxj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector; AC:H because both 802.1X and RADIUS proxy dynamic authorization must be co-configured (non-default); PR:L for low-privilege access; integrity-only impact as session revocation is blocked.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
Lifecycle Timeline
1DescriptionCVE.org
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network. Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
AnalysisAI
Arista EOS devices simultaneously running 802.1X port authentication and the RADIUS proxy feature with dynamic authorization can be manipulated by a low-privileged adjacent attacker to suppress RADIUS Change-of-Authorization (CoA) and Disconnect-Request messages targeting locally authenticated 802.1X sessions. By inducing a crafted RADIUS packet through a configured RADIUS proxy client interface, an attacker causes the switch to discard legitimate session-revocation orders from a RADIUS server or NAC system, allowing revoked endpoint sessions to persist on the network indefinitely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Both of the following non-default features must be explicitly configured on the Arista EOS device: (1) 802.1X port authentication with dynamic authorization enabled, and (2) RADIUS proxy with dynamic authorization enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.9 with vector AV:A/AC:L/AT:P/PR:L reflects a moderate real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Arista Security Advisory 0149 at https://www.arista.com/en/support/advisories-notices/security-advisory/24705-security-advisory-0149 for exact patched EOS release versions, as specific fixed release numbers beyond the stated affected ranges are not confirmed in the available input data and must be sourced directly from Arista. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today