CVE-2023-5502 (GCVE-0-2023-5502)

Vulnerability from cvelistv5 – Published: 2026-06-04 22:39 – Updated: 2026-06-05 18:30
VLAI
Title
On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.
Summary
On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-287 - Improper Authentication
Assigner
References
Impacted products
Vendor Product Version
Arista Networks EOS Affected: 4.31.0 , ≤ 4.31.0F (custom)
Affected: 4.30.0 , ≤ 4.30.4M (custom)
Affected: 4.29.0 , ≤ 4.29.6M (custom)
Affected: 4.28.0 , ≤ 4.28.8M (custom)
Affected: 4.27.0 , ≤ 4.27.11M (custom)
Affected: 4.26.0 , ≤ 4.26.11M (custom)
Affected: 4.25.0 , ≤ 4.25.11M (custom)
Affected: 4.24.0 , ≤ 4.24.11M (custom)
Create a notification for this product.
Date Public
2024-05-21 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5502",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T18:30:41.122247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T18:30:54.241Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "7020R Series",
            "7280R/R2 Series",
            "7500R/R2 Series",
            "7280E Series",
            "7500E Series"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.31.0F",
              "status": "affected",
              "version": "4.31.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.30.4M",
              "status": "affected",
              "version": "4.30.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.29.6M",
              "status": "affected",
              "version": "4.29.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.28.8M",
              "status": "affected",
              "version": "4.28.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.27.11M",
              "status": "affected",
              "version": "4.27.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.26.11M",
              "status": "affected",
              "version": "4.26.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.25.11M",
              "status": "affected",
              "version": "4.25.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.24.11M",
              "status": "affected",
              "version": "4.24.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order to be vulnerable to CVE-2023-5502, either of the following configuration conditions must be met:\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eCondition 1: Dot1x authentication must be configured:\u003c/strong\u003e\u003c/p\u003e\u003cpre\u003edot1x system-auth-control\ninterface Ethernet1\n dot1x pae authenticator\n dot1x port-control auto\n !! One of the two configuration lines below MUST be set\n dot1x host-mode single-host\n dot1x host-mode multi-host authenticated\ninterface Vlan100\n ip address 1.1.1.1/24\n ip routing\u003c/pre\u003e\u003cbr\u003e\u003cp\u003e\u003cstrong\u003eCondition 2: 802.1x configured in any host mode with MBA:\u003c/strong\u003e\u003c/p\u003e\u003cpre\u003edot1x system-auth-control\ninterface Ethernet1\n dot1x pae authenticator\n dot1x port-control auto\n dot1x mac based authentication\n !! One of the three configuration lines below MUST be set\n dot1x host-mode single-host\n dot1x host-mode multi-host authenticated\n dot1x host-mode multi-host\ninterface Vlan100\n ip address 1.1.1.1/24\n ip routing\u003c/pre\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2023-5502, either of the following configuration conditions must be met:\n\nCondition 1: Dot1x authentication must be configured:\n\ndot1x system-auth-control\ninterface Ethernet1\n dot1x pae authenticator\n dot1x port-control auto\n !! One of the two configuration lines below MUST be set\n dot1x host-mode single-host\n dot1x host-mode multi-host authenticated\ninterface Vlan100\n ip address 1.1.1.1/24\n ip routing\n\nCondition 2: 802.1x configured in any host mode with MBA:\n\ndot1x system-auth-control\ninterface Ethernet1\n dot1x pae authenticator\n dot1x port-control auto\n dot1x mac based authentication\n !! One of the three configuration lines below MUST be set\n dot1x host-mode single-host\n dot1x host-mode multi-host authenticated\n dot1x host-mode multi-host\ninterface Vlan100\n ip address 1.1.1.1/24\n ip routing"
        }
      ],
      "datePublic": "2024-05-21T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eOn affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T22:39:34.101Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19462-security-advisory-0096"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003cbr\u003eFor more information about upgrading see \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003eCVE-2023-5502 has been fixed in the following releases:\u003c/div\u003e\u003cul\u003e\u003cli\u003e4.32.0F and later releases in the 4.32.x train\u003c/li\u003e\u003cli\u003e4.31.3M and later releases in the 4.31.x train\u003c/li\u003e\u003cli\u003e4.30.5M and later releases in the 4.30.x train\u003c/li\u003e\u003cli\u003e4.29.7M and later releases in the 4.29.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNote: Products 7280E and 7500E are EOL, and there are no released versions of EOS which fix the issue on those platforms.\u003c/p\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\nFor more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2023-5502 has been fixed in the following releases:\n  * 4.32.0F and later releases in the 4.32.x train\n  * 4.31.3M and later releases in the 4.31.x train\n  * 4.30.5M and later releases in the 4.30.x train\n  * 4.29.7M and later releases in the 4.29.x train\n\nNote: Products 7280E and 7500E are EOL, and there are no released versions of EOS which fix the issue on those platforms."
        }
      ],
      "source": {
        "advisory": "0096",
        "defect": [
          "BUG 862986"
        ],
        "discovery": "INTERNAL"
      },
      "title": "On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMitigation of this vulnerability requires disabling dot1x. Dot1x can be disabled globally using the following command:\u003c/p\u003e\u003cpre\u003eno dot1x system-auth-control\u003c/pre\u003e"
            }
          ],
          "value": "Mitigation of this vulnerability requires disabling dot1x. Dot1x can be disabled globally using the following command:\n\nno dot1x system-auth-control"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2023-5502",
    "datePublished": "2026-06-04T22:39:34.101Z",
    "dateReserved": "2023-10-10T15:58:04.589Z",
    "dateUpdated": "2026-06-05T18:30:54.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-5502",
      "date": "2026-06-07",
      "epss": "0.0003",
      "percentile": "0.08935"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-5502\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2026-06-04T23:16:47.210\",\"lastModified\":\"2026-06-05T15:02:34.977\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/19462-security-advisory-0096\",\"source\":\"psirt@arista.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-5502\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-05T18:30:41.122247Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-05T18:30:50.610Z\"}}], \"cna\": {\"title\": \"On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.\", \"source\": {\"defect\": [\"BUG 862986\"], \"advisory\": \"0096\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.2, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.31.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.31.0F\"}, {\"status\": \"affected\", \"version\": \"4.30.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.30.4M\"}, {\"status\": \"affected\", \"version\": \"4.29.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.29.6M\"}, {\"status\": \"affected\", \"version\": \"4.28.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.28.8M\"}, {\"status\": \"affected\", \"version\": \"4.27.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.27.11M\"}, {\"status\": \"affected\", \"version\": \"4.26.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.26.11M\"}, {\"status\": \"affected\", \"version\": \"4.25.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.25.11M\"}, {\"status\": \"affected\", \"version\": \"4.24.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.24.11M\"}], \"platforms\": [\"7020R Series\", \"7280R/R2 Series\", \"7500R/R2 Series\", \"7280E Series\", \"7500E Series\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\\nFor more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \\n\\nCVE-2023-5502 has been fixed in the following releases:\\n  * 4.32.0F and later releases in the 4.32.x train\\n  * 4.31.3M and later releases in the 4.31.x train\\n  * 4.30.5M and later releases in the 4.30.x train\\n  * 4.29.7M and later releases in the 4.29.x train\\n\\nNote: Products 7280E and 7500E are EOL, and there are no released versions of EOS which fix the issue on those platforms.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003cbr\u003eFor more information about upgrading see \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\\\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003eCVE-2023-5502 has been fixed in the following releases:\u003c/div\u003e\u003cul\u003e\u003cli\u003e4.32.0F and later releases in the 4.32.x train\u003c/li\u003e\u003cli\u003e4.31.3M and later releases in the 4.31.x train\u003c/li\u003e\u003cli\u003e4.30.5M and later releases in the 4.30.x train\u003c/li\u003e\u003cli\u003e4.29.7M and later releases in the 4.29.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNote: Products 7280E and 7500E are EOL, and there are no released versions of EOS which fix the issue on those platforms.\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-05-21T16:00:00.000Z\", \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/19462-security-advisory-0096\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation of this vulnerability requires disabling dot1x. Dot1x can be disabled globally using the following command:\\n\\nno dot1x system-auth-control\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eMitigation of this vulnerability requires disabling dot1x. Dot1x can be disabled globally using the following command:\u003c/p\u003e\u003cpre\u003eno dot1x system-auth-control\u003c/pre\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan\u003eOn affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287 Improper Authentication\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In order to be vulnerable to CVE-2023-5502, either of the following configuration conditions must be met:\\n\\nCondition 1: Dot1x authentication must be configured:\\n\\ndot1x system-auth-control\\ninterface Ethernet1\\n dot1x pae authenticator\\n dot1x port-control auto\\n !! One of the two configuration lines below MUST be set\\n dot1x host-mode single-host\\n dot1x host-mode multi-host authenticated\\ninterface Vlan100\\n ip address 1.1.1.1/24\\n ip routing\\n\\nCondition 2: 802.1x configured in any host mode with MBA:\\n\\ndot1x system-auth-control\\ninterface Ethernet1\\n dot1x pae authenticator\\n dot1x port-control auto\\n dot1x mac based authentication\\n !! One of the three configuration lines below MUST be set\\n dot1x host-mode single-host\\n dot1x host-mode multi-host authenticated\\n dot1x host-mode multi-host\\ninterface Vlan100\\n ip address 1.1.1.1/24\\n ip routing\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn order to be vulnerable to CVE-2023-5502, either of the following configuration conditions must be met:\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eCondition 1: Dot1x authentication must be configured:\u003c/strong\u003e\u003c/p\u003e\u003cpre\u003edot1x system-auth-control\\ninterface Ethernet1\\n dot1x pae authenticator\\n dot1x port-control auto\\n !! One of the two configuration lines below MUST be set\\n dot1x host-mode single-host\\n dot1x host-mode multi-host authenticated\\ninterface Vlan100\\n ip address 1.1.1.1/24\\n ip routing\u003c/pre\u003e\u003cbr\u003e\u003cp\u003e\u003cstrong\u003eCondition 2: 802.1x configured in any host mode with MBA:\u003c/strong\u003e\u003c/p\u003e\u003cpre\u003edot1x system-auth-control\\ninterface Ethernet1\\n dot1x pae authenticator\\n dot1x port-control auto\\n dot1x mac based authentication\\n !! One of the three configuration lines below MUST be set\\n dot1x host-mode single-host\\n dot1x host-mode multi-host authenticated\\n dot1x host-mode multi-host\\ninterface Vlan100\\n ip address 1.1.1.1/24\\n ip routing\u003c/pre\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-06-04T22:39:34.101Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-5502\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-05T18:30:54.241Z\", \"dateReserved\": \"2023-10-10T15:58:04.589Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-06-04T22:39:34.101Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.