ARISTA EOS · CVE-2026-120977 · Infrastructure
FIX → 4.37.0F +4 ✓ verified
On Arista EOS switches with 802.1X authenticator ports, RADIUS accounting and a DHCP profiling option (radius av-pair dhcp ...) configured, an adjacent attacker can send a crafted DHCP packet so the switch records a spoofed device profile. The authenticated supplicant may then get access to a network segment with elevated privileges. Arista found it internally and knows of no exploitation.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only switches running Arista EOS with 802.1X authentication and DHCP device profiling both enabled are described as affected. The sources do not list affected EOS versions or name the exact configuration steps to confirm it, so teams should check whether DHCP device profiling is turned on in their 802.1X setup.
Not affected if ceos-lab, cloudeos, default-config, dhcp-profiling-disabled, no-802.1x, radius-accounting-disabled, veos-lab
Who cares 802.1x, arista-eos, dhcp, network-switches, self-hosted
show version and compare with affected: 4.36.2F and earlier, 4.35.5M and earlier, 4.34.7M and earlier, 4.33.9M and earlier, all 4.32.x, 4.31.x from 4.31.2Fshow running-config: vulnerable only if all of these are set: dot1x system-auth-control, at least one interface with dot1x pae authenticator, at least one of under dot1x, and RADIUS accounting ()On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
radius av-pair dhcp hostname|parameter-request-list|vendor-class-idaaa accounting dot1x default start-stop group radiusshow dot1x hosts mac <mac> accountingUpgrade to 4.37.0F +4