802.1x authentication bypass in Arista EOS

1) Improper authentication

EUVDB-ID: #VU109366

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-6858

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the 802.1X mode. A remote attacker on the local network can access a switch port if there exists an EAPOL capable device in the fallback VLAN.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Arista Extensible Operating System (EOS): before 4.28.11M, 4.29.8M, 4.30.6M, 4.31.2F

CPE2.3

• cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*

External links

https://www.arista.com/en/support/advisories-notices/security-advisory/19917-security-advisory-0103

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.