CVE-2023-5502 PUBLISHED

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.

Assigner: Arista
Reserved: 10.10.2023 Published: 04.06.2026 Updated: 04.06.2026

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	High	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 5.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Arista Networks
Product	EOS
Versions	Default: unaffected affected from 4.31.0 to 4.31.0F (incl.) affected from 4.30.0 to 4.30.4M (incl.) affected from 4.29.0 to 4.29.6M (incl.) affected from 4.28.0 to 4.28.8M (incl.) affected from 4.27.0 to 4.27.11M (incl.) affected from 4.26.0 to 4.26.11M (incl.) affected from 4.25.0 to 4.25.11M (incl.) affected from 4.24.0 to 4.24.11M (incl.)

Affected Configurations

In order to be vulnerable to CVE-2023-5502, either of the following configuration conditions must be met:

Condition 1: Dot1x authentication must be configured:

dot1x system-auth-control interface Ethernet1 dot1x pae authenticator dot1x port-control auto !! One of the two configuration lines below MUST be set dot1x host-mode single-host dot1x host-mode multi-host authenticated interface Vlan100 ip address 1.1.1.1/24 ip routing

Condition 2: 802.1x configured in any host mode with MBA:

dot1x system-auth-control interface Ethernet1 dot1x pae authenticator dot1x port-control auto dot1x mac based authentication !! One of the three configuration lines below MUST be set dot1x host-mode single-host dot1x host-mode multi-host authenticated dot1x host-mode multi-host interface Vlan100 ip address 1.1.1.1/24 ip routing

Workarounds

Mitigation of this vulnerability requires disabling dot1x. Dot1x can be disabled globally using the following command:

no dot1x system-auth-control

Solutions

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades

CVE-2023-5502 has been fixed in the following releases: * 4.32.0F and later releases in the 4.32.x train * 4.31.3M and later releases in the 4.31.x train * 4.30.5M and later releases in the 4.30.x train * 4.29.7M and later releases in the 4.29.x train

Note: Products 7280E and 7500E are EOL, and there are no released versions of EOS which fix the issue on those platforms.

References

https://www.arista.com/en/support/advisories-notices/security-advisory/19462-security-advisory-0096

Problem Types

CWE-287 Improper Authentication CWE

Impacts

CAPEC-115 Authentication Bypass