CVE-2024-6858 (GCVE-0-2024-6858)

Vulnerability from cvelistv5 – Published: 2026-06-04 21:51 – Updated: 2026-06-05 20:13
VLAI
Title
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
Summary
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
Severity
6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-1287 - Improper validation of specified type of input
Assigner
References
Impacted products
Vendor Product Version
Arista Networks EOS Affected: 4.31.0 , ≤ 4.31.1F (custom)
Affected: 4.30.0 , ≤ 4.30.5M (custom)
Affected: 4.29.0 , ≤ 4.29.7M (custom)
Affected: 4.28.10 , ≤ 4.28.10.1M (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-6858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T20:13:55.762154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T20:13:59.275Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010 Series",
            "7010X Series",
            "7020R Series",
            "7130 Series running EOS",
            "7150 Series",
            "7160 Series",
            "7170 Series",
            "7050X/X2/X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7250X Series",
            "7260X/X3 Series",
            "7280E/R/R2/R3 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500E/R/R2/R3 Series",
            "7800R3 Series"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.31.1F",
              "status": "affected",
              "version": "4.31.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.30.5M",
              "status": "affected",
              "version": "4.30.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.29.7M",
              "status": "affected",
              "version": "4.29.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.28.10.1M",
              "status": "affected",
              "version": "4.28.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order to be vulnerable to CVE-2024-6858, the following conditions must be met:\u003c/p\u003e\u003cp\u003e(1) dot1x should be configured on port as authenticator and port-control is auto mode and hostMode is multi-host. Please note the default host-mode is multi-host.\u003c/p\u003e\u003cpre\u003eswitch(config-if-et1)#show active\ninterface Ethernet1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x pae authenticator\u003cbr\u003e\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x port-control auto\u003cbr\u003e\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x host-mode multi-host\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u003c/pre\u003e\u003cp\u003eAND\u003cbr\u003e(2) Fallback VLAN should be configured on port. Fallback VLAN can be configured in any of the following ways listed below;\u003c/p\u003e\u003cp\u003e(2-a) Global Configuration for unresponsive VLAN.\u003c/p\u003e\u003cpre\u003eswitch(config-dot1x)#show active\ndot1x\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;aaa unresponsive action traffic allow vlan \u0026lt;vlan-id\u0026gt;\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n   \nOR\n   \nswitch(config-dot1x)#show active\ndot1x\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;aaa unresponsive action traffic allow\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-b) Global Configuration for unresponsive phone VLAN.\u003c/div\u003e\u003cpre\u003eswitch(config-dot1x)#show active\ndot1x\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;aaa unresponsive phone action traffic allow\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-c) Global Configuration for guest VLAN.\u003c/div\u003e\u003cpre\u003eswitch(config-dot1x)#show active\ndot1x\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;eapol unresponsive action traffic allow vlan \u0026lt;vlan-id\u0026gt;\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-d) Authentication failure VLAN configured on port.\u003c/div\u003e\u003cpre\u003eswitch(config-if-et1)#show active\ninterface Ethernet1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x authentication failure action traffic allow vlan \u0026lt;vlan_id\u0026gt;\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-e) Unresponsive VLAN configured on port.\u003c/div\u003e\u003cpre\u003eswitch(config-if-et1)#show active\ninterface Ethernet1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x aaa unresponsive action traffic allow vlan \u0026lt;vlan_id\u0026gt;\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-f) Unresponsive phone VLAN configured on port.\u003c/div\u003e\u003cpre\u003eswitch(config-if-et1)#show active\ninterface Ethernet1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x aaa unresponsive phone action traffic allow\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\u2026\u2026\u2026\u003c/pre\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2024-6858, the following conditions must be met:\n\n\n\n(1) dot1x should be configured on port as authenticator and port-control is auto mode and hostMode is multi-host. Please note the default host-mode is multi-host.\n\n\n\nswitch(config-if-et1)#show active\ninterface Ethernet1\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0dot1x pae authenticator\n\n\u00a0\u00a0\u00a0dot1x port-control auto\n\n\u00a0\u00a0\u00a0dot1x host-mode multi-host\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\n\n\n\nAND\n(2) Fallback VLAN should be configured on port. Fallback VLAN can be configured in any of the following ways listed below;\n\n\n\n(2-a) Global Configuration for unresponsive VLAN.\n\n\n\nswitch(config-dot1x)#show active\ndot1x\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0aaa unresponsive action traffic allow vlan \u003cvlan-id\u003e\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n   \nOR\n   \nswitch(config-dot1x)#show active\ndot1x\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0aaa unresponsive action traffic allow\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\n\n\u00a0\n\nOR\n(2-b) Global Configuration for unresponsive phone VLAN.\n\n\n\nswitch(config-dot1x)#show active\ndot1x\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0aaa unresponsive phone action traffic allow\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\n\n\u00a0\n\nOR\n(2-c) Global Configuration for guest VLAN.\n\n\n\nswitch(config-dot1x)#show active\ndot1x\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0eapol unresponsive action traffic allow vlan \u003cvlan-id\u003e\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\n\n\u00a0\n\nOR\n(2-d) Authentication failure VLAN configured on port.\n\n\n\nswitch(config-if-et1)#show active\ninterface Ethernet1\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0dot1x authentication failure action traffic allow vlan \u003cvlan_id\u003e\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\n\n\u00a0\n\nOR\n(2-e) Unresponsive VLAN configured on port.\n\n\n\nswitch(config-if-et1)#show active\ninterface Ethernet1\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0dot1x aaa unresponsive action traffic allow vlan \u003cvlan_id\u003e\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\n\n\u00a0\n\nOR\n(2-f) Unresponsive phone VLAN configured on port.\n\n\n\nswitch(config-if-et1)#show active\ninterface Ethernet1\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026\n\u00a0\u00a0\u00a0dot1x aaa unresponsive phone action traffic allow\n\u00a0\u00a0\u00a0\u2026\u2026\u2026\u2026"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Arista\u2019s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN."
            }
          ],
          "value": "In Arista\u2019s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1287",
              "description": "CWE-1287 Improper validation of specified type of input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T21:51:08.709Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19917-security-advisory-0103"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see\u0026nbsp;\u003ca href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003eCVE-2024-6858 has been fixed in the following releases:\u003c/div\u003e\u003cul\u003e\u003cli\u003e4.31.2F and later releases in the 4.31.x train.\u003c/li\u003e\u003cli\u003e4.30.6M and later releases in the 4.30.x train.\u003c/li\u003e\u003cli\u003e4.29.8M and later releases in the 4.29.x train.\u003c/li\u003e\u003cli\u003e4.28.11M and later releases in the 4.28.x train.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see\u00a0 EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2024-6858 has been fixed in the following releases:\n\n  *  4.31.2F and later releases in the 4.31.x train.\n  *  4.30.6M and later releases in the 4.30.x train.\n  *  4.29.8M and later releases in the 4.29.x train.\n  *  4.28.11M and later releases in the 4.28.x train."
        }
      ],
      "source": {
        "advisory": "103",
        "defect": [
          "BUG 828435"
        ],
        "discovery": "INTERNAL"
      },
      "title": "In Arista\u2019s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis vulnerability arises when there is an EAPOL supplicant in any of the fallback VLAN\u2019s ( i.e. auth-fail, unresponsive VLAN ). If only unauthenticated EAPOL supplicants are expected the admin can change dot1x host-mode to single-host as indicated below.\u003c/p\u003e\u003cpre\u003eswitch(config-if-et1)#dot1x host-mode single-host\n\u003c/pre\u003e\u003cul\u003e\u003cli\u003eDot1x Host Mode\u003cbr\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eSingle Host Mode: Please note when once the 802.1X supplicant is authenticated on the port, ONLY the traffic coming from the supplicant\u0027s MAC is allowed through the port.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eMulti-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from ANY source MAC is allowed through the port.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eMulti-Host authenticated Mode: Multiple 802.1X supplicants can be allowed and ONLY the traffic coming from all authenticated supplicant\u2019s MAC is allowed through the port.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "This vulnerability arises when there is an EAPOL supplicant in any of the fallback VLAN\u2019s ( i.e. auth-fail, unresponsive VLAN ). If only unauthenticated EAPOL supplicants are expected the admin can change dot1x host-mode to single-host as indicated below.\n\n\n\nswitch(config-if-et1)#dot1x host-mode single-host\n\n\n  *  Dot1x Host Mode\n  *  \n\nSingle Host Mode: Please note when once the 802.1X supplicant is authenticated on the port, ONLY the traffic coming from the supplicant\u0027s MAC is allowed through the port.\n\n\n  *  \n\nMulti-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from ANY source MAC is allowed through the port.\n\n\n  *  \n\nMulti-Host authenticated Mode: Multiple 802.1X supplicants can be allowed and ONLY the traffic coming from all authenticated supplicant\u2019s MAC is allowed through the port."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2024-6858",
    "datePublished": "2026-06-04T21:51:08.709Z",
    "dateReserved": "2024-07-17T20:13:57.799Z",
    "dateUpdated": "2026-06-05T20:13:59.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-6858",
      "date": "2026-06-08",
      "epss": "0.00122",
      "percentile": "0.30828"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-6858\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2026-06-04T22:16:51.843\",\"lastModified\":\"2026-06-05T21:16:27.760\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Arista\u2019s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1287\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/19917-security-advisory-0103\",\"source\":\"psirt@arista.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"In Arista\\u2019s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.\", \"source\": {\"defect\": [\"BUG 828435\"], \"advisory\": \"103\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.31.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.31.1F\"}, {\"status\": \"affected\", \"version\": \"4.30.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.30.5M\"}, {\"status\": \"affected\", \"version\": \"4.29.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.29.7M\"}, {\"status\": \"affected\", \"version\": \"4.28.10\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.28.10.1M\"}], \"platforms\": [\"720D Series\", \"720XP/722XPM Series\", \"750X Series\", \"7010 Series\", \"7010X Series\", \"7020R Series\", \"7130 Series running EOS\", \"7150 Series\", \"7160 Series\", \"7170 Series\", \"7050X/X2/X3/X4 Series\", \"7060X/X2/X4/X5/X6 Series\", \"7250X Series\", \"7260X/X3 Series\", \"7280E/R/R2/R3 Series\", \"7300X/X3 Series\", \"7320X Series\", \"7358X4 Series\", \"7368X4 Series\", \"7388X5 Series\", \"7500E/R/R2/R3 Series\", \"7800R3 Series\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see\\u00a0 EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \\n\\nCVE-2024-6858 has been fixed in the following releases:\\n\\n  *  4.31.2F and later releases in the 4.31.x train.\\n  *  4.30.6M and later releases in the 4.30.x train.\\n  *  4.29.8M and later releases in the 4.29.x train.\\n  *  4.28.11M and later releases in the 4.28.x train.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see\u0026nbsp;\u003ca href=\\\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\\\" target=\\\"_blank\\\" rel=\\\"noopener noreferrer\\\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003eCVE-2024-6858 has been fixed in the following releases:\u003c/div\u003e\u003cul\u003e\u003cli\u003e4.31.2F and later releases in the 4.31.x train.\u003c/li\u003e\u003cli\u003e4.30.6M and later releases in the 4.30.x train.\u003c/li\u003e\u003cli\u003e4.29.8M and later releases in the 4.29.x train.\u003c/li\u003e\u003cli\u003e4.28.11M and later releases in the 4.28.x train.\u003c/li\u003e\u003c/ul\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/19917-security-advisory-0103\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"This vulnerability arises when there is an EAPOL supplicant in any of the fallback VLAN\\u2019s ( i.e. auth-fail, unresponsive VLAN ). If only unauthenticated EAPOL supplicants are expected the admin can change dot1x host-mode to single-host as indicated below.\\n\\n\\n\\nswitch(config-if-et1)#dot1x host-mode single-host\\n\\n\\n  *  Dot1x Host Mode\\n  *  \\n\\nSingle Host Mode: Please note when once the 802.1X supplicant is authenticated on the port, ONLY the traffic coming from the supplicant\u0027s MAC is allowed through the port.\\n\\n\\n  *  \\n\\nMulti-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from ANY source MAC is allowed through the port.\\n\\n\\n  *  \\n\\nMulti-Host authenticated Mode: Multiple 802.1X supplicants can be allowed and ONLY the traffic coming from all authenticated supplicant\\u2019s MAC is allowed through the port.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThis vulnerability arises when there is an EAPOL supplicant in any of the fallback VLAN\\u2019s ( i.e. auth-fail, unresponsive VLAN ). If only unauthenticated EAPOL supplicants are expected the admin can change dot1x host-mode to single-host as indicated below.\u003c/p\u003e\u003cpre\u003eswitch(config-if-et1)#dot1x host-mode single-host\\n\u003c/pre\u003e\u003cul\u003e\u003cli\u003eDot1x Host Mode\u003cbr\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eSingle Host Mode: Please note when once the 802.1X supplicant is authenticated on the port, ONLY the traffic coming from the supplicant\u0027s MAC is allowed through the port.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eMulti-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from ANY source MAC is allowed through the port.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eMulti-Host authenticated Mode: Multiple 802.1X supplicants can be allowed and ONLY the traffic coming from all authenticated supplicant\\u2019s MAC is allowed through the port.\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Arista\\u2019s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In Arista\\u2019s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1287\", \"description\": \"CWE-1287 Improper validation of specified type of input\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In order to be vulnerable to CVE-2024-6858, the following conditions must be met:\\n\\n\\n\\n(1) dot1x should be configured on port as authenticator and port-control is auto mode and hostMode is multi-host. Please note the default host-mode is multi-host.\\n\\n\\n\\nswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0dot1x pae authenticator\\n\\n\\u00a0\\u00a0\\u00a0dot1x port-control auto\\n\\n\\u00a0\\u00a0\\u00a0dot1x host-mode multi-host\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\n\\n\\n\\nAND\\n(2) Fallback VLAN should be configured on port. Fallback VLAN can be configured in any of the following ways listed below;\\n\\n\\n\\n(2-a) Global Configuration for unresponsive VLAN.\\n\\n\\n\\nswitch(config-dot1x)#show active\\ndot1x\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0aaa unresponsive action traffic allow vlan \u003cvlan-id\u003e\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n   \\nOR\\n   \\nswitch(config-dot1x)#show active\\ndot1x\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0aaa unresponsive action traffic allow\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\n\\n\\u00a0\\n\\nOR\\n(2-b) Global Configuration for unresponsive phone VLAN.\\n\\n\\n\\nswitch(config-dot1x)#show active\\ndot1x\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0aaa unresponsive phone action traffic allow\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\n\\n\\u00a0\\n\\nOR\\n(2-c) Global Configuration for guest VLAN.\\n\\n\\n\\nswitch(config-dot1x)#show active\\ndot1x\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0eapol unresponsive action traffic allow vlan \u003cvlan-id\u003e\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\n\\n\\u00a0\\n\\nOR\\n(2-d) Authentication failure VLAN configured on port.\\n\\n\\n\\nswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0dot1x authentication failure action traffic allow vlan \u003cvlan_id\u003e\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\n\\n\\u00a0\\n\\nOR\\n(2-e) Unresponsive VLAN configured on port.\\n\\n\\n\\nswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0dot1x aaa unresponsive action traffic allow vlan \u003cvlan_id\u003e\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\n\\n\\u00a0\\n\\nOR\\n(2-f) Unresponsive phone VLAN configured on port.\\n\\n\\n\\nswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\\n\\u00a0\\u00a0\\u00a0dot1x aaa unresponsive phone action traffic allow\\n\\u00a0\\u00a0\\u00a0\\u2026\\u2026\\u2026\\u2026\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn order to be vulnerable to CVE-2024-6858, the following conditions must be met:\u003c/p\u003e\u003cp\u003e(1) dot1x should be configured on port as authenticator and port-control is auto mode and hostMode is multi-host. Please note the default host-mode is multi-host.\u003c/p\u003e\u003cpre\u003eswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x pae authenticator\u003cbr\u003e\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x port-control auto\u003cbr\u003e\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x host-mode multi-host\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u003c/pre\u003e\u003cp\u003eAND\u003cbr\u003e(2) Fallback VLAN should be configured on port. Fallback VLAN can be configured in any of the following ways listed below;\u003c/p\u003e\u003cp\u003e(2-a) Global Configuration for unresponsive VLAN.\u003c/p\u003e\u003cpre\u003eswitch(config-dot1x)#show active\\ndot1x\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;aaa unresponsive action traffic allow vlan \u0026lt;vlan-id\u0026gt;\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n   \\nOR\\n   \\nswitch(config-dot1x)#show active\\ndot1x\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;aaa unresponsive action traffic allow\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-b) Global Configuration for unresponsive phone VLAN.\u003c/div\u003e\u003cpre\u003eswitch(config-dot1x)#show active\\ndot1x\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;aaa unresponsive phone action traffic allow\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-c) Global Configuration for guest VLAN.\u003c/div\u003e\u003cpre\u003eswitch(config-dot1x)#show active\\ndot1x\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;eapol unresponsive action traffic allow vlan \u0026lt;vlan-id\u0026gt;\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-d) Authentication failure VLAN configured on port.\u003c/div\u003e\u003cpre\u003eswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x authentication failure action traffic allow vlan \u0026lt;vlan_id\u0026gt;\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-e) Unresponsive VLAN configured on port.\u003c/div\u003e\u003cpre\u003eswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x aaa unresponsive action traffic allow vlan \u0026lt;vlan_id\u0026gt;\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eOR\u003cbr\u003e(2-f) Unresponsive phone VLAN configured on port.\u003c/div\u003e\u003cpre\u003eswitch(config-if-et1)#show active\\ninterface Ethernet1\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x aaa unresponsive phone action traffic allow\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\\u2026\\u2026\\u2026\\u2026\u003c/pre\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-06-04T21:51:08.709Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-6858\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-05T20:13:55.762154Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-06-05T20:13:52.087Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-6858\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-04T21:51:08.709Z\", \"dateReserved\": \"2024-07-17T20:13:57.799Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-06-04T21:51:08.709Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.