---
id: "CVE-2026-120977"
page: "https://infrastack.ai/live/CVE-2026-120977"
kind: "vulnerability"
aliases: ["CVE-2026-120977"]
title: "Arista EOS: crafted DHCP packet spoofs device profile, gaining network access"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Arista EOS", "fixed": ["4.37.0F", "4.36.3M", "4.35.6M", "4.34.8M", "4.33.10M"], "affected": "<= 4.36.2F (4.36.x), <= 4.35.5M (4.35.x), <= 4.34.7M (4.34.x), <= 4.33.9M (4.33.x), all 4.32.x, 4.31.x from 4.31.2F", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["802.1x", "arista-eos", "dhcp", "infrastructure", "network-switches", "self-hosted"]
not_affected_if: ["ceos-lab", "cloudeos", "default-config", "dhcp-profiling-disabled", "no-802.1x", "radius-accounting-disabled", "veos-lab"]
published_at: "2026-11-10T20:18:52+00:00"
first_seen_at: "2026-11-10T20:46:03+00:00"
updated_at: "2026-11-10T20:59:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120977", "first_seen_at": "2026-11-10T20:46:03+00:00"}, {"source": "analyst", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217", "first_seen_at": "2026-11-10T20:59:54+00:00", "cites": ["https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217"]}]
exploit_sources: []
---

# Arista EOS: crafted DHCP packet spoofs device profile, gaining network access

Link for people: https://infrastack.ai/live/CVE-2026-120977 (this .md is for agents)

On Arista EOS switches with 802.1X authenticator ports, RADIUS accounting and a DHCP profiling option (radius av-pair dhcp ...) configured, an adjacent attacker can send a crafted DHCP packet so the switch records a spoofed device profile. The authenticated supplicant may then get access to a network segment with elevated privileges. Arista found it internally and knows of no exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Arista EOS affected <= 4.36.2F (4.36.x), <= 4.35.5M (4.35.x), <= 4.34.7M (4.34.x), <= 4.33.9M (4.33.x), all 4.32.x, 4.31.x from 4.31.2F fixed 4.37.0F, 4.36.3M, 4.35.6M, 4.34.8M, 4.33.10M

## How to check

Run 'show version' and compare with affected: 4.36.2F and earlier, 4.35.5M and earlier, 4.34.7M and earlier, 4.33.9M and earlier, all 4.32.x, 4.31.x from 4.31.2F. Then 'show running-config': vulnerable only if all of these are set: dot1x system-auth-control, at least one interface with 'dot1x pae authenticator', at least one of 'radius av-pair dhcp hostname|parameter-request-list|vendor-class-id' under dot1x, and RADIUS accounting ('aaa accounting dot1x default start-stop group radius'). To look for abuse, inspect RADIUS accounting for mismatched supplicant profiles: 'show dot1x hosts mac <mac> accounting'.

## Fix

Upgrade EOS to 4.37.0F, 4.36.3M, 4.35.6M, 4.34.8M or 4.33.10M or later in your train. No fix in train for 4.32.x and 4.31.x (move to a fixed train). No hotfix and no workaround, per Arista.

## Timeline

- 2026-11-10T20:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120977
- 2026-11-10T20:59:54+00:00 analyst https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217 — Read Arista SA 0217 (primary). Affected/fixed versions, required config, no workaround, no hotfix, not exploited per vendor.

## Documents

- [advisory] Arista Security Advisory 0217 https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217

## From the sources

On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_