CVE-2024-6858

Vulnerability

In Arista's EOS when operating in 802.1X mode, unauthenticated hosts may gain access to a switch port if an EAPOL-capable device is present in the fallback VLAN. This vulnerability affects EOS versions 4.31.1F and below in the 4.31.x train, 4.30.5M and below in the 4.30.x train, 4.29.7M and below in the 4.29.x train, and 4.28.10.1M and below in the 4.28.x train [1].

Exploitation

An attacker requires network access to a switch port and the presence of an EAPOL-capable device in the fallback VLAN. The attacker can then leverage the multi-authentication feature in 802.1X mode to gain unauthorized access to the switch port without proper authentication [1].

Impact

Successful exploitation allows an unauthenticated host to gain access to a switch port, potentially leading to unauthorized network access and information disclosure. The scope of the compromise is limited to the switch port itself, but could allow further lateral movement within the network [1].

Mitigation

Arista has released fixed versions of EOS. Specific fixed versions include 4.31.1F+, 4.30.5M+, 4.29.7M+, and 4.28.10.1M+. Arista is not aware of any malicious uses of this issue in customer networks [1].