A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.\n" } ] } ], "references": [ { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150" } ], "configurations": [ { "lang": "en", "value": "In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\n\n * 802.1X (dot1x in the CLI) must be configured with pae authenticator \n\n\n * port-control must be set to auto mode \n\n\n * A static or dynamic ACL must be configured. \n\n\n * The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\n \n\n\n\nBelow is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.\n\n\n\nswitch(config-if-et1)#show active\n \ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\n \ndot1x system-auth-control\n\n\n \n\n\n\nIn this example port control is in “auto” mode, necessary for the condition to occur.\n\n\n\nconfig)#show dot1x interface ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\n\n\n \n\n\n\n Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\n\n\n\nswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\n\n \n\n\n\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\n\n\n\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\n\n\n\nswitch(config)#show ip access-lists interface Ethernet5 summary \nIP Access List EMPLOYEE-ACL\n 10 permit ip 10.0.0.0/8 any\n 20 deny ip any any\n \n Total rules configured: 2\n Configured on Ingress: Ethernet5\n Active on Ingress: Ethernet5 \n\n\n\n\n\n\n\nIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:\n\n\n\nswitch(config-dot1x)#clear dot1x host all", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "
" } ] } ], "workarounds": [ { "lang": "en", "value": "For CVE-2026-75945, rerunning the 'clear dot1x host all' command is presented only as conditional mitigation advice when a supplicant remains authenticated.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:
- 802.1X (dot1x in the CLI) must be configured with pae authenticator
- port-control must be set to auto mode
- A static or dynamic ACL must be configured.
- The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule
Below is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.
switch(config-if-et1)#show active\n \ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\n \ndot1x system-auth-control\nIn this example port control is in “auto” mode, necessary for the condition to occur.
config)#show dot1x interface ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\nUse a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP
switch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.
To verify the configured ACL, execute the following show command to identify the ACL applied to the interface:
switch(config)#show ip access-lists interface Ethernet5 summary \nIP Access List EMPLOYEE-ACL\n 10 permit ip 10.0.0.0/8 any\n 20 deny ip any any\n \n Total rules configured: 2\n Configured on Ingress: Ethernet5\n Active on Ingress: Ethernet5 \nIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:
switch(config-dot1x)#clear dot1x host all
\nFor CVE-2026-75945, rerunning the 'clear dot1x host all' command is presented only as conditional mitigation advice when a supplicant remains authenticated.\n" } ] } ], "solutions": [ { "lang": "en", "value": "CVE-2026-75945 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "
\nCVE-2026-75945 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.\n" } ] } ], "credits": [ { "lang": "en", "value": "Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks.", "type": "finder" } ], "source": { "advisory": "Security Advisory 0150", "discovery": "INTERNAL", "defects": [ "BUG 1857804" ] }, "x_generator": { "engine": "Vulnogram 1.0.5" }, "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 2.6, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" } }, { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" } } ] }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-09-14T23:05:47.041923Z", "id": "CVE-2026-75945", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T23:05:54.600Z" } } ] } }