In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
Summary
| CVE | CVE-2024-6858 |
|---|---|
| State | PUBLISHED |
| Assigner | Arista |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-04 22:16:51 UTC |
| Updated | 2026-06-04 22:16:51 UTC |
| Description | In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. |
Risk And Classification
Problem Types: CWE-1287 | CWE-1287 CWE-1287 Improper validation of specified type of input
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Arista Networks | EOS | affected 4.31.0 4.31.1F custom | 720D Series, 720XP/722XPM Series, 750X Series, 7010 Series, 7010X Series, 7020R Series, 7130 Series running EOS, 7150 Series, 7160 Series, 7170 Series, 7050X/X2/X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7250X Series, 7260X/X3 Series, 7280E/R/R2/R3 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500E/R/R2/R3 Series, 7800R3 Series |
| CNA | Arista Networks | EOS | affected 4.30.0 4.30.5M custom | 720D Series, 720XP/722XPM Series, 750X Series, 7010 Series, 7010X Series, 7020R Series, 7130 Series running EOS, 7150 Series, 7160 Series, 7170 Series, 7050X/X2/X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7250X Series, 7260X/X3 Series, 7280E/R/R2/R3 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500E/R/R2/R3 Series, 7800R3 Series |
| CNA | Arista Networks | EOS | affected 4.29.0 4.29.7M custom | 720D Series, 720XP/722XPM Series, 750X Series, 7010 Series, 7010X Series, 7020R Series, 7130 Series running EOS, 7150 Series, 7160 Series, 7170 Series, 7050X/X2/X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7250X Series, 7260X/X3 Series, 7280E/R/R2/R3 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500E/R/R2/R3 Series, 7800R3 Series |
| CNA | Arista Networks | EOS | affected 4.28.10 4.28.10.1M custom | 720D Series, 720XP/722XPM Series, 750X Series, 7010 Series, 7010X Series, 7020R Series, 7130 Series running EOS, 7150 Series, 7160 Series, 7170 Series, 7050X/X2/X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7250X Series, 7260X/X3 Series, 7280E/R/R2/R3 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500E/R/R2/R3 Series, 7800R3 Series |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.arista.com/en/support/advisories-notices/security-advisory/19917-securit... | [email protected] | www.arista.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-6858 has been fixed in the following releases: * 4.31.2F and later releases in the 4.31.x train. * 4.30.6M and later releases in the 4.30.x train. * 4.29.8M and later releases in the 4.29.x train. * 4.28.11M and later releases in the 4.28.x train.
Workarounds
CNA: This vulnerability arises when there is an EAPOL supplicant in any of the fallback VLAN’s ( i.e. auth-fail, unresponsive VLAN ). If only unauthenticated EAPOL supplicants are expected the admin can change dot1x host-mode to single-host as indicated below. switch(config-if-et1)#dot1x host-mode single-host * Dot1x Host Mode * Single Host Mode: Please note when once the 802.1X supplicant is authenticated on the port, ONLY the traffic coming from the supplicant's MAC is allowed through the port. * Multi-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from ANY source MAC is allowed through the port. * Multi-Host authenticated Mode: Multiple 802.1X supplicants can be allowed and ONLY the traffic coming from all authenticated supplicant’s MAC is allowed through the port.