{"id":"CVE-2026-120977","kind":"vulnerability","aliases":["CVE-2026-120977"],"related":[],"title":"Arista EOS: crafted DHCP packet spoofs device profile, gaining network access","description":"On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges.","summary":"On Arista EOS switches with 802.1X authenticator ports, RADIUS accounting and a DHCP profiling option (radius av-pair dhcp ...) configured, an adjacent attacker can send a crafted DHCP packet so the switch records a spoofed device profile. The authenticated supplicant may then get access to a network segment with elevated privileges. Arista found it internally and knows of no exploitation.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Arista EOS","fixed":["4.37.0F","4.36.3M","4.35.6M","4.34.8M","4.33.10M"],"affected":"<= 4.36.2F (4.36.x), <= 4.35.5M (4.35.x), <= 4.34.7M (4.34.x), <= 4.33.9M (4.33.x), all 4.32.x, 4.31.x from 4.31.2F","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["802.1x","arista-eos","dhcp","infrastructure","network-switches","self-hosted"],"not_affected_if":["ceos-lab","cloudeos","default-config","dhcp-profiling-disabled","no-802.1x","radius-accounting-disabled","veos-lab"],"how_to_check":"Run 'show version' and compare with affected: 4.36.2F and earlier, 4.35.5M and earlier, 4.34.7M and earlier, 4.33.9M and earlier, all 4.32.x, 4.31.x from 4.31.2F. Then 'show running-config': vulnerable only if all of these are set: dot1x system-auth-control, at least one interface with 'dot1x pae authenticator', at least one of 'radius av-pair dhcp hostname|parameter-request-list|vendor-class-id' under dot1x, and RADIUS accounting ('aaa accounting dot1x default start-stop group radius'). To look for abuse, inspect RADIUS accounting for mismatched supplicant profiles: 'show dot1x hosts mac <mac> accounting'.","fix":"Upgrade EOS to 4.37.0F, 4.36.3M, 4.35.6M, 4.34.8M or 4.33.10M or later in your train. No fix in train for 4.32.x and 4.31.x (move to a fixed train). No hotfix and no workaround, per Arista.","status":"open","published_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","triaged_at":"2026-11-10T20:47:32+00:00","updated_at":"2026-11-10T20:59:54+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T20:47:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: crafted DHCP packet spoofs device profile, gaining network access","impact":"medium","summary":"On Arista EOS switches running 802.1X with DHCP device profiling enabled, a nearby attacker can send a crafted DHCP packet that makes the device record a spoofed device profile. The authenticated device may then gain access to a network segment with elevated privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","802.1x","dhcp","network-switches"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated device gains unauthorized access to elevated network segment","analyst_note":"Find the affected and fixed EOS versions and the vendor advisory for CVE-2026-120977 at the Arista security advisories page, and confirm how DHCP device profiling is enabled.","how_to_check":"unknown","plain_action":"","product_name":"Arista EOS","needs_analyst":true,"not_affected_if":["default-config","dhcp-profiling-disabled","no-802.1x"],"who_is_affected":"Only switches running Arista EOS with 802.1X authentication and DHCP device profiling both enabled are described as affected. The sources do not list affected EOS versions or name the exact configuration steps to confirm it, so teams should check whether DHCP device profiling is turned on in their 802.1X setup.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4583,"output_tokens":556,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed EOS versions and the vendor advisory for CVE-2026-120977 at the Arista security advisories page, and confirm how DHCP device profiling is enabled.","search":"'-120977':14A,17A '-2026':13A,16A '802.1':20B,38B,102C 'access':11A,78B,144C 'account':43B 'acquir':142C 'adjac':56B,116C 'affect':96C 'allow':137C 'arista':1A,18A,23B,34B,86B,99C 'arista-eo':22B 'attack':57B,117C 'authent':40B,73B,139C 'av':51B 'av-pair':50B 'configur':54B,107C 'craft':3A,61B,121C 'cve':12A,15A 'devic':7A,70B,110C,127C,132C 'dhcp':4A,25B,46B,53B,62B,109C,122C 'dynam':105C 'elev':84B,150C 'enabl':112C 'eo':2A,24B,35B,100C 'eos':19A 'exploit':94B 'forc':125C 'found':87B 'gain':9A 'get':77B 'host':32B,106C 'infrastructur':26B 'intern':89B 'know':91B 'may':75B,135C 'network':10A,28B,81B,115C,147C 'network-adjac':114C 'network-switch':27B 'option':48B 'packet':5A,63B,123C 'pair':52B 'platform':97C 'port':41B 'potenti':136C 'privileg':85B,151C 'profil':8A,47B,71B,111C,133C 'protocol':108C 'radius':42B,49B 'record':67B,129C 'run':98C 'segment':82B,148C 'self':31B 'self-host':30B 'send':59B,119C 'spoof':6A,69B,131C 'supplic':74B,140C 'switch':29B,36B,66B 'unauthor':143C 'x':21B,39B,103C","nicknames":[],"mitigations":[],"who_affected":"Only switches running Arista EOS with 802.1X authentication and DHCP device profiling both enabled are described as affected. The sources do not list affected EOS versions or name the exact configuration steps to confirm it, so teams should check whether DHCP device profiling is turned on in their 802.1X setup.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:59:54Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","run_id":2735},"products":{"at":"2026-11-10T20:59:54Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","run_id":2735},"mitigations":{"at":"2026-11-10T20:59:54Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","run_id":2735},"workarounds":{"at":"2026-11-10T20:59:54Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","run_id":2735},"how_to_check":{"at":"2026-11-10T20:59:54Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","run_id":2735},"who_affected":{"at":"2026-11-10T20:59:54Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","run_id":2735}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aristaeos","eos"],"ptokens":["arista","eos"],"labels":["8021x","aristaeos","dhcp","high","infrastructure","networkswitches","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120977':14A,17A '-2026':13A,16A 'access':11A 'arista':1A,18A 'craft':3A 'cve':12A,15A 'devic':7A 'dhcp':4A 'eo':2A 'eos':19A 'gain':9A 'network':10A 'packet':5A 'profil':8A 'spoof':6A","search_b":"'802.1':20B,38B 'access':78B 'account':43B 'adjac':56B 'arista':23B,34B,86B 'arista-eo':22B 'attack':57B 'authent':40B,73B 'av':51B 'av-pair':50B 'configur':54B 'craft':61B 'devic':70B 'dhcp':25B,46B,53B,62B 'elev':84B 'eo':24B,35B 'exploit':94B 'found':87B 'get':77B 'host':32B 'infrastructur':26B 'intern':89B 'know':91B 'may':75B 'network':28B,81B 'network-switch':27B 'option':48B 'packet':63B 'pair':52B 'port':41B 'privileg':85B 'profil':47B,71B 'radius':42B,49B 'record':67B 'segment':82B 'self':31B 'self-host':30B 'send':59B 'spoof':69B 'supplic':74B 'switch':29B,36B,66B 'x':21B,39B","search_c":"'802.1':102C 'access':144C 'acquir':142C 'adjac':116C 'affect':96C 'allow':137C 'arista':99C 'attack':117C 'authent':139C 'configur':107C 'craft':121C 'devic':110C,127C,132C 'dhcp':109C,122C 'dynam':105C 'elev':150C 'enabl':112C 'eo':100C 'forc':125C 'host':106C 'may':135C 'network':115C,147C 'network-adjac':114C 'packet':123C 'platform':97C 'potenti':136C 'privileg':151C 'profil':111C,133C 'protocol':108C 'record':129C 'run':98C 'segment':148C 'send':119C 'spoof':131C 'supplic':140C 'unauthor':143C 'x':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120977","severity":null,"published_at":"2026-11-10T20:18:52+00:00","modified_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","fetched_at":"2026-11-10T20:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120977:2735","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","severity":null,"published_at":"2026-11-10T20:59:54+00:00","modified_at":"2026-11-10T20:59:54+00:00","first_seen_at":"2026-11-10T20:59:54+00:00","fetched_at":"2026-11-10T20:59:54+00:00","note":"Read Arista SA 0217 (primary). Affected/fixed versions, required config, no workaround, no hotfix, not exploited per vendor.","cites":["https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217"]}],"documents":[{"id":118465,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217","title":"Arista Security Advisory 0217","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}