GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-75945 (GCVE-0-2026-75945)

Vulnerability from cvelistv5 – Published: 2026-09-14 22:23 – Updated: 2026-09-14 23:05
VLAI
Title
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
Summary
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
Severity
2.6 (Low)
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
2.1 (Low)
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 23:05 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Arista Networks EOS Affected: 4.36.0 , ≤ 4.36.1F (custom)
guessed Create a notification for this product.
Date Public
2026-09-09 22:20
Credits
Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75945",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T23:05:47.041923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T23:05:54.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\u003cp\u003eIn order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\u003c/p\u003e\u003col\u003e\u003cli\u003e802.1X (dot1x in the CLI) must be configured with \u003cb\u003epae authenticator\u003c/b\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eport-control must be set to auto mode\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eA static or dynamic ACL must be configured.\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eThe RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\u003c/li\u003e\u003c/ol\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eBelow is an example of one configuration. Note that \u201cmac based authentication always\u201d is optional The supplicant can authenticate with either EAPOL or MBA.\u003c/p\u003e\u003cpre\u003eswitch(config-if-et1)#show active\n  \ninterface Ethernet5\n\u0026nbsp;\u0026nbsp;\u0026nbsp;switchport mode trunk\n\u0026nbsp;\u0026nbsp;\u0026nbsp;spanning-tree portfast edge\n   dot1x pae authenticator\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x port-control auto\n  \ndot1x system-auth-control\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn this example port control is in \u201cauto\u201d mode, necessary for the condition to occur.\u003c/p\u003e\u003cpre\u003econfig)#show\u0026nbsp; dot1x\u0026nbsp; interface\u0026nbsp; ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n  \nDot1X Authenticator Client\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003e\u0026nbsp; Use a preconfigured ACL with which the RADIUS server returns in the \u003cb\u003eFilter-Id\u003c/b\u003e AVP\u003c/p\u003e\u003cpre\u003eswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eAAA server will return the ACL name through \u003cb\u003eFilter-Id\u003c/b\u003e AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\u003c/p\u003e\u003cp\u003eTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\u003c/p\u003e\u003cpre\u003eswitch(config)#show ip access-lists interface Ethernet5 summary\u0026nbsp;\nIP Access List EMPLOYEE-ACL\n\u0026nbsp;\u0026nbsp;\u0026nbsp;10 permit ip 10.0.0.0/8 any\n\u0026nbsp;\u0026nbsp;\u0026nbsp;20 deny ip any any\n  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;Total rules configured: 2\n\u0026nbsp;\u0026nbsp;\u0026nbsp;Configured on Ingress: Ethernet5\n\u0026nbsp;\u0026nbsp;\u0026nbsp;Active on Ingress: Ethernet5\u0026nbsp;\n\u003c/pre\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:\u003c/p\u003e\u003cpre\u003eswitch(config-dot1x)#clear dot1x host all\u003c/pre\u003e\u003c/pre\u003e"
            }
          ],
          "value": "In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\n\n  *  802.1X (dot1x in the CLI) must be configured with pae authenticator\u00a0\n\n\n  *  port-control must be set to auto mode\u00a0\n\n\n  *  A static or dynamic ACL must be configured.\u00a0\n\n\n  *  The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\n\u00a0\n\n\n\nBelow is an example of one configuration. Note that \u201cmac based authentication always\u201d is optional The supplicant can authenticate with either EAPOL or MBA.\n\n\n\nswitch(config-if-et1)#show active\n  \ninterface Ethernet5\n\u00a0\u00a0\u00a0switchport mode trunk\n\u00a0\u00a0\u00a0spanning-tree portfast edge\n   dot1x pae authenticator\n\u00a0\u00a0\u00a0dot1x port-control auto\n  \ndot1x system-auth-control\n\n\n\u00a0\n\n\n\nIn this example port control is in \u201cauto\u201d mode, necessary for the condition to occur.\n\n\n\nconfig)#show\u00a0 dot1x\u00a0 interface\u00a0 ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n  \nDot1X Authenticator Client\n\n\n\u00a0\n\n\n\n\u00a0 Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\n\n\n\nswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\n\n\u00a0\n\n\n\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\n\n\n\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\n\n\n\nswitch(config)#show ip access-lists interface Ethernet5 summary\u00a0\nIP Access List EMPLOYEE-ACL\n\u00a0\u00a0\u00a010 permit ip 10.0.0.0/8 any\n\u00a0\u00a0\u00a020 deny ip any any\n  \n\u00a0\u00a0\u00a0Total rules configured: 2\n\u00a0\u00a0\u00a0Configured on Ingress: Ethernet5\n\u00a0\u00a0\u00a0Active on Ingress: Ethernet5\u00a0\n\n\n\n\n\n\n\nIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:\n\n\n\nswitch(config-dot1x)#clear dot1x host all"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks."
        }
      ],
      "datePublic": "2026-09-09T22:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eA race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.\n\u003c/pre\u003e"
            }
          ],
          "value": "A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T22:23:02.391Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\nCVE-2026-75945 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.\n\u003c/pre\u003e"
            }
          ],
          "value": "CVE-2026-75945 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train."
        }
      ],
      "source": {
        "advisory": "Security Advisory 0150",
        "defects": [
          "BUG 1857804"
        ],
        "discovery": "INTERNAL"
      },
      "title": "A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\nFor CVE-2026-75945, rerunning the \u0027clear dot1x host all\u0027 command is presented only as conditional mitigation advice when a supplicant remains authenticated.\n\u003c/pre\u003e"
            }
          ],
          "value": "For CVE-2026-75945, rerunning the \u0027clear dot1x host all\u0027 command is presented only as conditional mitigation advice when a supplicant remains authenticated."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-75945",
    "datePublished": "2026-09-14T22:23:02.391Z",
    "dateReserved": "2026-08-18T16:04:12.507Z",
    "dateUpdated": "2026-09-14T23:05:54.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-75945\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2026-09-14T23:18:35.970\",\"lastModified\":\"2026-09-15T00:17:30.387\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.\"}],\"affected\":[{\"source\":\"psirt@arista.com\",\"affectedData\":[{\"vendor\":\"Arista Networks\",\"product\":\"EOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.36.0\",\"lessThanOrEqual\":\"4.36.1F\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":2.6,\"baseSeverity\":\"LOW\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T23:05:47.041923Z\",\"id\":\"CVE-2026-75945\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-459\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150\",\"source\":\"psirt@arista.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-75945\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T23:05:47.041923Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T23:05:51.409Z\"}}], \"cna\": {\"title\": \"A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.\", \"source\": {\"defects\": [\"BUG 1857804\"], \"advisory\": \"Security Advisory 0150\", \"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks.\"}], \"impacts\": [{\"capecId\": \"CAPEC-180\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 2.6, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.36.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.36.1F\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"CVE-2026-75945 has been fixed in the following release:\\n* 4.36.2F and later releases in the 4.36.x train.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cpre\u003e\\nCVE-2026-75945 has been fixed in the following release:\\n* 4.36.2F and later releases in the 4.36.x train.\\n\u003c/pre\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-09-09T22:20:00.000Z\", \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"For CVE-2026-75945, rerunning the \u0027clear dot1x host all\u0027 command is presented only as conditional mitigation advice when a supplicant remains authenticated.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cpre\u003e\\nFor CVE-2026-75945, rerunning the \u0027clear dot1x host all\u0027 command is presented only as conditional mitigation advice when a supplicant remains authenticated.\\n\u003c/pre\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cpre\u003eA race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.\\n\u003c/pre\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-459\", \"description\": \"CWE-459 Incomplete Cleanup\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\\n\\n  *  802.1X (dot1x in the CLI) must be configured with pae authenticator\\u00a0\\n\\n\\n  *  port-control must be set to auto mode\\u00a0\\n\\n\\n  *  A static or dynamic ACL must be configured.\\u00a0\\n\\n\\n  *  The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\\n\\u00a0\\n\\n\\n\\nBelow is an example of one configuration. Note that \\u201cmac based authentication always\\u201d is optional The supplicant can authenticate with either EAPOL or MBA.\\n\\n\\n\\nswitch(config-if-et1)#show active\\n  \\ninterface Ethernet5\\n\\u00a0\\u00a0\\u00a0switchport mode trunk\\n\\u00a0\\u00a0\\u00a0spanning-tree portfast edge\\n   dot1x pae authenticator\\n\\u00a0\\u00a0\\u00a0dot1x port-control auto\\n  \\ndot1x system-auth-control\\n\\n\\n\\u00a0\\n\\n\\n\\nIn this example port control is in \\u201cauto\\u201d mode, necessary for the condition to occur.\\n\\n\\n\\nconfig)#show\\u00a0 dot1x\\u00a0 interface\\u00a0 ethernet 5 details\\nDot1X Information for Ethernet5\\n--------------------------------------------\\nPort control: auto\\nForced phone authorization: disabled\\nEAPOL: enabled\\nHost mode: multi-host\\nMAC-based authentication: enabled\\nMAC-based authentication host mode: Unconfigured\\nMAC-based authentication always: enabled\\nQuiet period: 60 seconds\\nTX period: 5 seconds\\nMaximum reauth requests: 2\\nIgnore reauth timeout: No\\nAuth failure VLAN: Unconfigured\\nUnauthorized access VLAN egress: No\\nUnauthorized native VLAN egress: No\\nEAPOL authentication failure fallback: Unconfigured\\nPort ErrDisabled by CoA: no\\n  \\nDot1X Authenticator Client\\n\\n\\n\\u00a0\\n\\n\\n\\n\\u00a0 Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\\n\\n\\n\\nswitch(config)#ip access-list EMPLOYEE-ACL\\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\\n\\n\\n\\u00a0\\n\\n\\n\\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\\n\\n\\n\\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\\n\\n\\n\\nswitch(config)#show ip access-lists interface Ethernet5 summary\\u00a0\\nIP Access List EMPLOYEE-ACL\\n\\u00a0\\u00a0\\u00a010 permit ip 10.0.0.0/8 any\\n\\u00a0\\u00a0\\u00a020 deny ip any any\\n  \\n\\u00a0\\u00a0\\u00a0Total rules configured: 2\\n\\u00a0\\u00a0\\u00a0Configured on Ingress: Ethernet5\\n\\u00a0\\u00a0\\u00a0Active on Ingress: Ethernet5\\u00a0\\n\\n\\n\\n\\n\\n\\n\\nIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:\\n\\n\\n\\nswitch(config-dot1x)#clear dot1x host all\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cpre\u003e\u003cp\u003eIn order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\u003c/p\u003e\u003col\u003e\u003cli\u003e802.1X (dot1x in the CLI) must be configured with \u003cb\u003epae authenticator\u003c/b\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eport-control must be set to auto mode\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eA static or dynamic ACL must be configured.\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eThe RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\u003c/li\u003e\u003c/ol\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eBelow is an example of one configuration. Note that \\u201cmac based authentication always\\u201d is optional The supplicant can authenticate with either EAPOL or MBA.\u003c/p\u003e\u003cpre\u003eswitch(config-if-et1)#show active\\n  \\ninterface Ethernet5\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;switchport mode trunk\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;spanning-tree portfast edge\\n   dot1x pae authenticator\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x port-control auto\\n  \\ndot1x system-auth-control\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn this example port control is in \\u201cauto\\u201d mode, necessary for the condition to occur.\u003c/p\u003e\u003cpre\u003econfig)#show\u0026nbsp; dot1x\u0026nbsp; interface\u0026nbsp; ethernet 5 details\\nDot1X Information for Ethernet5\\n--------------------------------------------\\nPort control: auto\\nForced phone authorization: disabled\\nEAPOL: enabled\\nHost mode: multi-host\\nMAC-based authentication: enabled\\nMAC-based authentication host mode: Unconfigured\\nMAC-based authentication always: enabled\\nQuiet period: 60 seconds\\nTX period: 5 seconds\\nMaximum reauth requests: 2\\nIgnore reauth timeout: No\\nAuth failure VLAN: Unconfigured\\nUnauthorized access VLAN egress: No\\nUnauthorized native VLAN egress: No\\nEAPOL authentication failure fallback: Unconfigured\\nPort ErrDisabled by CoA: no\\n  \\nDot1X Authenticator Client\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003e\u0026nbsp; Use a preconfigured ACL with which the RADIUS server returns in the \u003cb\u003eFilter-Id\u003c/b\u003e AVP\u003c/p\u003e\u003cpre\u003eswitch(config)#ip access-list EMPLOYEE-ACL\\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eAAA server will return the ACL name through \u003cb\u003eFilter-Id\u003c/b\u003e AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\u003c/p\u003e\u003cp\u003eTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\u003c/p\u003e\u003cpre\u003eswitch(config)#show ip access-lists interface Ethernet5 summary\u0026nbsp;\\nIP Access List EMPLOYEE-ACL\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;10 permit ip 10.0.0.0/8 any\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;20 deny ip any any\\n  \\n\u0026nbsp;\u0026nbsp;\u0026nbsp;Total rules configured: 2\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;Configured on Ingress: Ethernet5\\n\u0026nbsp;\u0026nbsp;\u0026nbsp;Active on Ingress: Ethernet5\u0026nbsp;\\n\u003c/pre\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:\u003c/p\u003e\u003cpre\u003eswitch(config-dot1x)#clear dot1x host all\u003c/pre\u003e\u003c/pre\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-09-14T22:23:02.391Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-75945\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-14T23:05:54.600Z\", \"dateReserved\": \"2026-08-18T16:04:12.507Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-09-14T22:23:02.391Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.