{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 215 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25037-security-advisory-0215" } ], "title": "Security Advisory 215", "tracking": { "current_release_date": "2026-11-08T09:58:17Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 215", "initial_release_date": "2026-11-08T09:58:17Z", "revision_history": [ { "date": "2026-11-08T09:58:17Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.34.8", "product": { "name": "EOS version 4.34.8", "product_id": "CSAFPID-5" } }, { "category": "product_version", "name": "EOS version 4.36.2", "product": { "name": "EOS version 4.36.2", "product_id": "CSAFPID-0" } }, { "category": "product_version", "name": "EOS version 1.0.0", "product": { "name": "EOS version 1.0.0", "product_id": "CSAFPID-2" } }, { "category": "product_version", "name": "EOS version 4.35.6", "product": { "name": "EOS version 4.35.6", "product_id": "CSAFPID-4" } }, { "category": "product_version", "name": "EOS version 4.33.10", "product": { "name": "EOS version 4.33.10", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-120983", "id": { "system_name": "Arista Bug ID", "text": "903925" }, "notes": [ { "category": "description", "text": "On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.", "title": "CVE Description" }, { "category": "other", "text": "In order to be exploitable, 802.1x has to be configured in multi-host authentication mode with either Extensible Authentication Protocol over LAN (EAPOL) or MAC-Based Authentication (MBA) authentication of supplicants along with a PBR policy with an active routing action applied to the same ingress VLAN. This also requires at least one host to be authenticated on Dot1x port. \n## Dot1x Config\nUse the show active CLI command in interface config mode, or otherwise view the running configuration, to check if 802.1x is configured in multi-host authenticated mode with the EAPOL authentication method.\n\nFor example, the below configuration shows Ethernet21/1 interface with 802.1x configured in multi-host authenticated mode with EAPOL authentication.\n```\nconfig#interface Ethernet21/1\nconfig-if-Et21/1#show active\ninterface Ethernet21/1\n speed forced 100gfull\n switchport access vlan 2\n dot1x pae authenticator\n dot1x port-control auto\n dot1x host-mode multi-host authenticated\n```\n\nThis issue is present even if MBA is configured, which would appear in the interface mode as `dot1x mac based authentication`. This is because even with the MBA configured, EAPOL will still be allowed.\n\nAuthenticated 802.1X hosts can be listed with:\n```\nswitch#show Dot1x hosts\nPort Supplicant MAC Username Auth State Fallback VLAN VLAN Name\n---------- --------------- ------------------------------ ------ ------------------------ ----------------------- ------ ----------\nEt21/1 0001.0203.0405 00:01:02:03:04:05 MBA SUCCESS NONE 2 VLAN0002\nEt21/1 a64f.2694.d67d arastra EAPOL SUCCESS NONE 2 VLAN0002\n```\n## PBR Config: \nUse the `show policy-map type pbr` CLI command to check If PBR config is present. If active routing action is set in the CLI output it means PBR is functioning and will redirect the packet to specified nexthop.\n\nBoth Dot1x and PBR must be running on the same VLAN for this issue to occur.\n\nTo Check for PBR configuration and identify the active routing action is set and visible: \n```\nswitch# show policy-map type pbr\nService policy PermitAnyPolicy\n Configured on: Vlan2\n Applied on: Vlan2\n 10: Class-map: PermitAnyClass (match-any)\n Match: 10 IP Access List PermitAnyAcl\n counters per-entry\n 10 permit ip any any\n\n Configured actions: set nexthop 30.1.1.2\n Active routing action:\n VRF default\n Route to nexthop 30.1.1.2 default\n```\n", "title": "903925: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-2" ], "fixed": [ "CSAFPID-0", "CSAFPID-3", "CSAFPID-4", "CSAFPID-5" ] }, "references": [ { "category": "external", "summary": "MITRE CVE Entry", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-120983" }, { "category": "external", "summary": "MITRE URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-120983" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.10", "product_ids": [ "CSAFPID-3" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.8", "product_ids": [ "CSAFPID-5" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.6", "product_ids": [ "CSAFPID-4" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.2", "product_ids": [ "CSAFPID-0" ] }, { "category": "none_available", "details": "Not fixed in EOS version 1.0.0", "product_ids": [ "CSAFPID-2" ] }, { "category": "mitigation", "details": "Configure the PBR policy with specific, trusted address ranges rather than broad match rules. When defining match rules for PBR, only permit IP addresses or ranges that belong to trusted, authenticated hosts. Note: restricting the PBR ACL will affect all traffic matching those rules. Ensure the permitted source ranges include all legitimate authenticated hosts before applying this change.\n\nFor example, instead of allowing any source IP address, as described in the requirements for exploitation. The following rule restricts matching strictly to the 20.1.1.0/24 subnet:\n```\nip access-list PermitAnyAcl\n counters per-entry\n 10 permit ip 20.1.1.0/24 any\n```" } ], "scores": [ { "cvss_v3": { "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-0", "CSAFPID-4", "CSAFPID-2", "CSAFPID-3", "CSAFPID-5" ] } ], "title": "CVE-2026-120983" } ] }