CVE-2026-73449
MediumCVSS 5.9Summary
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.
Risk Assessment
An attacker on an adjacent network segment can maintain unauthorized network access by preventing session disconnection ordered by a RADIUS server or NAC system. This may lead to unauthorized access to network resources and violation of security policies.
Recommendation
Apply fixes provided by Arista for EOS or restrict the RADIUS proxy with dynamic authorization configuration if not essential. Monitor 802.1X sessions for unexpected persistence.
Other vulnerabilities in Arista EOS
See all- CVE-2015-8236High
Arista EOS versions before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allow remote attackers to execute arbitrary code as root by leveraging management-plane access.
- CVE-2026-73437Critical
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source.
- CVE-2026-7473MediumActively exploited
On affected platforms running Arista EOS, a tunnel decapsulation configuration, such as VXLAN, decap-groups, or a GRE tunnel interface, may lead to incorrect decapsulation and forwarding of other unexpected tunneled packets. This issue arises from the switch's failure to verify the tunnel protocol type.
- CVE-2024-27892Critical
On platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
- CVE-2024-27890Critical
Platforms running Arista EOS with OpenConfig configured may accept gNMI Set requests that should have been rejected, leading to unexpected configuration changes on the switch.
- CVE-2025-8873High
Vulnerability in Arista EOS with IPsec configured. A specially crafted packet can stop all IPsec traffic processing in the dataplane. After reset, traffic may not resume. Non-IPsec traffic is unaffected.
- CVE-2024-27891Medium
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
- CVE-2023-5502Medium
On platforms running Arista EOS with 802.1x authentication configured on access/trunk ports and routing enabled on the access VLAN, a malicious supplicant may bypass the requirement to perform 802.1x authentication.
- CVE-2024-6858Medium
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
- CVE-2023-3646Medium
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.
Original NVD description (English source)
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network. Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.