Protection Mechanism Failure in Arista Extensible Operating System (EOS) - CVE-2024-8000
Published: May 17, 2025
Vulnerability identifier: #VU109384
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-8000
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error when handling dynamic ACLs when running Arista EOS with 802.1x. Under certain circumstances a dynamic ACL can be sent by the AAA server resulting in only the
first line of the ACL being installed after an Accelerated Software
Upgrade (ASU) restart.
Affected software
Arista Extensible Operating System (EOS)
How to mitigate CVE-2024-8000
Install updates from vendor's website.
Arista Extensible Operating System (EOS) - addressed in versions 4.30.9M, 4.31.6M, 4.32.5M, 4.33.0M