EUVD-2026-78211
GHSA-w63v-3gq5-cj26
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network, authenticated supplicant required, high complexity due to sub-second timing window; only low integrity impact from transient ACL bypass.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
Lifecycle Timeline
2DescriptionCVE.org
A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.
AnalysisAI
Arista EOS 802.1X port-based access control exposes a brief ACL enforcement gap (milliseconds to seconds) when an authenticated supplicant is removed - either by the 'clear dot1x host all' CLI command or by supplicant timeout. During this window, the departing supplicant's traffic transits the switch without ACL enforcement, potentially reaching network segments the ACL was meant to restrict. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) 802.1X dot1x authentication must be configured and active on the Arista EOS switch; (2) the attacker must already hold a valid authenticated supplicant session (PR:L - not unauthenticated); (3) the supplicant must be in the process of being removed, either via explicit 'clear dot1x host all' CLI execution by an administrator or via natural supplicant timeout; (4) the attacker must successfully inject traffic within the millisecond-to-second ACL teardown window (AT:P); (5) the adjacent network attack vector (AV:A) confines this to local network segments - no remote internet exposure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.1 (AV:A/AC:L/AT:P/PR:L) accurately reflects a low-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Arista PSIRT advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150 for fixed release versions beyond the affected boundaries (>4.33.9M in the 4.33 train, >4.34.7.1M in the 4.34 train, >4.35.5M in the 4.35 train, >4.36.1F in the 4.36 train). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-459 – Incomplete Cleanup
View allShare
External POC / Exploit Code
Leaving vuln.today