228 lines
15 KiB
JSON
228 lines
15 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-75945",
|
||
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Arista",
|
||
"dateReserved": "2026-08-18T16:04:12.507Z",
|
||
"datePublished": "2026-09-14T22:23:02.391Z",
|
||
"dateUpdated": "2026-09-14T23:05:54.600Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
|
||
"shortName": "Arista",
|
||
"dateUpdated": "2026-09-14T22:23:02.391Z"
|
||
},
|
||
"title": "A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.",
|
||
"datePublic": "2026-09-09T22:20:00.000Z",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-459",
|
||
"description": "CWE-459 Incomplete Cleanup",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-180",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "Arista Networks",
|
||
"product": "EOS",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "4.36.0",
|
||
"lessThanOrEqual": "4.36.1F",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<pre>A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.\n</pre>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"
|
||
}
|
||
],
|
||
"configurations": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\n\n * 802.1X (dot1x in the CLI) must be configured with pae authenticator \n\n\n * port-control must be set to auto mode \n\n\n * A static or dynamic ACL must be configured. \n\n\n * The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\n \n\n\n\nBelow is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.\n\n\n\nswitch(config-if-et1)#show active\n \ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\n \ndot1x system-auth-control\n\n\n \n\n\n\nIn this example port control is in “auto” mode, necessary for the condition to occur.\n\n\n\nconfig)#show dot1x interface ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\n\n\n \n\n\n\n Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\n\n\n\nswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\n\n \n\n\n\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\n\n\n\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\n\n\n\nswitch(config)#show ip access-lists interface Ethernet5 summary \nIP Access List EMPLOYEE-ACL\n 10 permit ip 10.0.0.0/8 any\n 20 deny ip any any\n \n Total rules configured: 2\n Configured on Ingress: Ethernet5\n Active on Ingress: Ethernet5 \n\n\n\n\n\n\n\nIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:\n\n\n\nswitch(config-dot1x)#clear dot1x host all",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<pre><p>In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:</p><ol><li>802.1X (dot1x in the CLI) must be configured with <b>pae authenticator</b><div> </div></li><li>port-control must be set to auto mode<div> </div></li><li>A static or dynamic ACL must be configured.<div> </div></li><li>The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule</li></ol><div> </div><p>Below is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.</p><pre>switch(config-if-et1)#show active\n \ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\n \ndot1x system-auth-control\n</pre><div> </div><p>In this example port control is in “auto” mode, necessary for the condition to occur.</p><pre>config)#show dot1x interface ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\n</pre><div> </div><p> Use a preconfigured ACL with which the RADIUS server returns in the <b>Filter-Id</b> AVP</p><pre>switch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n</pre><div> </div><p>AAA server will return the ACL name through <b>Filter-Id</b> AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.</p><p>To verify the configured ACL, execute the following show command to identify the ACL applied to the interface:</p><pre>switch(config)#show ip access-lists interface Ethernet5 summary \nIP Access List EMPLOYEE-ACL\n 10 permit ip 10.0.0.0/8 any\n 20 deny ip any any\n \n Total rules configured: 2\n Configured on Ingress: Ethernet5\n Active on Ingress: Ethernet5 \n</pre><div><br></div><p>In addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:</p><pre>switch(config-dot1x)#clear dot1x host all</pre></pre>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"workarounds": [
|
||
{
|
||
"lang": "en",
|
||
"value": "For CVE-2026-75945, rerunning the 'clear dot1x host all' command is presented only as conditional mitigation advice when a supplicant remains authenticated.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<pre>\nFor CVE-2026-75945, rerunning the 'clear dot1x host all' command is presented only as conditional mitigation advice when a supplicant remains authenticated.\n</pre>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CVE-2026-75945 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<pre>\nCVE-2026-75945 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.\n</pre>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks.",
|
||
"type": "finder"
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "Security Advisory 0150",
|
||
"discovery": "INTERNAL",
|
||
"defects": [
|
||
"BUG 1857804"
|
||
]
|
||
},
|
||
"x_generator": {
|
||
"engine": "Vulnogram 1.0.5"
|
||
},
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"attackVector": "ADJACENT_NETWORK",
|
||
"attackComplexity": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"userInteraction": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "LOW",
|
||
"availabilityImpact": "NONE",
|
||
"baseSeverity": "LOW",
|
||
"baseScore": 2.6,
|
||
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
|
||
}
|
||
},
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV4_0": {
|
||
"attackVector": "ADJACENT",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "PRESENT",
|
||
"privilegesRequired": "LOW",
|
||
"userInteraction": "NONE",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"subConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "LOW",
|
||
"subIntegrityImpact": "NONE",
|
||
"vulnAvailabilityImpact": "NONE",
|
||
"subAvailabilityImpact": "NONE",
|
||
"exploitMaturity": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"version": "4.0",
|
||
"baseSeverity": "LOW",
|
||
"baseScore": 2.1,
|
||
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-09-14T23:05:47.041923Z",
|
||
"id": "CVE-2026-75945",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-09-14T23:05:54.600Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |