GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-73449 (GCVE-0-2026-73449)

Vulnerability from cvelistv5 – Published: 2026-09-14 21:57 – Updated: 2026-09-15 19:11
VLAI
Title
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI
Summary
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network. Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
5.9 (Medium)
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
5.9 (Medium)
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:11 UTC
CWE
  • CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Vendor Product Version CPE status
Arista Networks EOS Affected: 4.36.0 , ≤ 4.36.1F (custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom)
Affected: 4.34.0 , ≤ 4.34.7.1M (custom)
guessed Create a notification for this product.
Date Public
2026-09-09 21:54
Credits
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T19:11:42.553584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:11:51.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.7.1M",
              "status": "affected",
              "version": "4.34.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\nIn order to be vulnerable to CVE-2026-73449, both of the following conditions must be met:\n1. 802.1X must be enabled with RADIUS dynamic authorization\nThe running configuration must contain dot1x system-auth-control and dot1x dynamic-authorization, with one or more interfaces configured for authentication:\nswitch# show running-config section dot1x\n   dot1x system-auth-control\n   dot1x dynamic-authorization\n   ...\n   interface Ethernet1\n      dot1x pae authenticator\n      dot1x port-control auto\n\nAuthenticated 802.1X sessions can be listed with:\nswitch#show dot1x hosts\n   Port Supplicant MAC Username Auth State Fallback VLAN VLAN Name\n   Et30 0017.0100.0001 00:17:01:00:00:01 MBA SUCCESS NONE 30* VLAN0030\n   Et30 606b.5ba7.73c5 60:6b:5b:a7:73:c5 MBA SUCCESS NONE 30* VLAN0030\n\n2. RADIUS proxy must be enabled with dynamic authorization\nThe running configuration contains a radius proxy section with at least one client group and the dynamic-authorization command:\nswitch# show running-config section radius proxy\n   radius proxy\n      dynamic-authorization\n      client group CG1\n         client ipv4 10.0.0.0/24 vrf default\n         server group SG1\n\nThe state of the RADIUS proxy feature can be confirmed with:\nswitch# show radius proxy client group\n   Radius Client Group : CG1\n   Last time counters were cleared : never\n   Dynamic authorization : enabled\n   Dynamic authorization destination port : \u0026lt;portNumber\u0026gt;\n      Client : \u0026lt;clientName\u0026gt;, authentication port 1812, accounting port 1813, vrf default\n      Resolved IP address : \u0026lt;resolvedIp\u0026gt;\n   \u2026\n\nIf the output of this command shows \"Dynamic authorization: disabled\", or if either the radius proxy section or the 802.1X configuration above is absent, there is no exposure to the issue.\n\u003c/pre\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2026-73449, both of the following conditions must be met:\n1. 802.1X must be enabled with RADIUS dynamic authorization\nThe running configuration must contain dot1x system-auth-control and dot1x dynamic-authorization, with one or more interfaces configured for authentication:\nswitch# show running-config section dot1x\n   dot1x system-auth-control\n   dot1x dynamic-authorization\n   ...\n   interface Ethernet1\n      dot1x pae authenticator\n      dot1x port-control auto\n\nAuthenticated 802.1X sessions can be listed with:\nswitch#show dot1x hosts\n   Port Supplicant MAC Username Auth State Fallback VLAN VLAN Name\n   Et30 0017.0100.0001 00:17:01:00:00:01 MBA SUCCESS NONE 30* VLAN0030\n   Et30 606b.5ba7.73c5 60:6b:5b:a7:73:c5 MBA SUCCESS NONE 30* VLAN0030\n\n2. RADIUS proxy must be enabled with dynamic authorization\nThe running configuration contains a radius proxy section with at least one client group and the dynamic-authorization command:\nswitch# show running-config section radius proxy\n   radius proxy\n      dynamic-authorization\n      client group CG1\n         client ipv4 10.0.0.0/24 vrf default\n         server group SG1\n\nThe state of the RADIUS proxy feature can be confirmed with:\nswitch# show radius proxy client group\n   Radius Client Group : CG1\n   Last time counters were cleared : never\n   Dynamic authorization : enabled\n   Dynamic authorization destination port : \u003cportNumber\u003e\n      Client : \u003cclientName\u003e, authentication port 1812, accounting port 1813, vrf default\n      Resolved IP address : \u003cresolvedIp\u003e\n   \u2026\n\nIf the output of this command shows \"Dynamic authorization: disabled\", or if either the radius proxy section or the 802.1X configuration above is absent, there is no exposure to the issue."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
        }
      ],
      "datePublic": "2026-09-09T21:54:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eOn affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions.\nThis allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.\nBoth 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue.\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\n\u003c/pre\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions.\nThis allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.\nBoth 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue.\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T21:57:39.220Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24705-security-advisory-0149"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\nThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\nCVE-2026-73449 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n\u003c/pre\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\nCVE-2026-73449 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train"
        }
      ],
      "source": {
        "advisory": "149",
        "defect": [
          "1697784"
        ],
        "defects": [
          "BUG 1697784"
        ],
        "discovery": "INTERNAL"
      },
      "title": "On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\nIf the RADIUS proxy dynamic authorization function is not operationally required, disabling it removes the exposure. Please note this operation will stop the switch from forwarding CoA and Disconnect requests to downstream RADIUS proxy clients. Dynamic authorization of the switch\u0027s own local 802.1X sessions continues to work.\n\nswitch(config)# radius proxy\nswitch(config-radius-proxy)# no dynamic-authorization\n\nIf RADIUS proxy dynamic authorization must remain enabled, the exposure window can be reduced (but not eliminated) by lowering the proxy client session idle timeout from its default of 600 seconds:\n\nswitch(config)# radius proxy\nswitch(config-radius-proxy)# client session idle-timeout \u0026lt;seconds\u0026gt; seconds\n\nNote that if the idle-timeout is being reduced, then radius proxy clients should increase the frequency of interim-update accounting requests. For more information about idle-timeout configuration see \u201cConfiguring session idle-timeout\u201d section in RADIUS Proxy.\nIf a specific endpoint must be forcibly disconnected while this issue is unresolved, the following command can be used.\n\nswitch(config)# clear dot1x host mac \u0026lt;endpoint macAddress\u0026gt;\n\u003c/pre\u003e"
            }
          ],
          "value": "If the RADIUS proxy dynamic authorization function is not operationally required, disabling it removes the exposure. Please note this operation will stop the switch from forwarding CoA and Disconnect requests to downstream RADIUS proxy clients. Dynamic authorization of the switch\u0027s own local 802.1X sessions continues to work.\n\nswitch(config)# radius proxy\nswitch(config-radius-proxy)# no dynamic-authorization\n\nIf RADIUS proxy dynamic authorization must remain enabled, the exposure window can be reduced (but not eliminated) by lowering the proxy client session idle timeout from its default of 600 seconds:\n\nswitch(config)# radius proxy\nswitch(config-radius-proxy)# client session idle-timeout \u003cseconds\u003e seconds\n\nNote that if the idle-timeout is being reduced, then radius proxy clients should increase the frequency of interim-update accounting requests. For more information about idle-timeout configuration see \u201cConfiguring session idle-timeout\u201d section in RADIUS Proxy.\nIf a specific endpoint must be forcibly disconnected while this issue is unresolved, the following command can be used.\n\nswitch(config)# clear dot1x host mac \u003cendpoint macAddress\u003e"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-73449",
    "datePublished": "2026-09-14T21:57:39.220Z",
    "dateReserved": "2026-08-12T16:42:47.921Z",
    "dateUpdated": "2026-09-15T19:11:51.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73449",
      "date": "2026-09-16",
      "epss": "0.00145",
      "percentile": "0.04189"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73449\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2026-09-14T22:16:57.650\",\"lastModified\":\"2026-09-15T19:17:38.747\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions.\\nThis allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.\\nBoth 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue.\\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\"}],\"affected\":[{\"source\":\"psirt@arista.com\",\"affectedData\":[{\"vendor\":\"Arista Networks\",\"product\":\"EOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.36.0\",\"lessThanOrEqual\":\"4.36.1F\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.35.0\",\"lessThanOrEqual\":\"4.35.5M\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.34.0\",\"lessThanOrEqual\":\"4.34.7.1M\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T19:11:42.553584Z\",\"id\":\"CVE-2026-73449\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/24705-security-advisory-0149\",\"source\":\"psirt@arista.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-09-14T21:57:39.220Z\"}, \"title\": \"On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI\", \"datePublic\": \"2026-09-09T21:54:00.000Z\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-290\", \"description\": \"CWE-290 Authentication Bypass by Spoofing\", \"type\": \"CWE\"}]}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.36.0\", \"lessThanOrEqual\": \"4.36.1F\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.35.0\", \"lessThanOrEqual\": \"4.35.5M\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.34.0\", \"lessThanOrEqual\": \"4.34.7.1M\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions.\\nThis allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.\\nBoth 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue.\\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cpre\u003eOn affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions.\\nThis allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.\\nBoth 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue.\\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\\n\u003c/pre\u003e\"}]}], \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24705-security-advisory-0149\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In order to be vulnerable to CVE-2026-73449, both of the following conditions must be met:\\n1. 802.1X must be enabled with RADIUS dynamic authorization\\nThe running configuration must contain dot1x system-auth-control and dot1x dynamic-authorization, with one or more interfaces configured for authentication:\\nswitch# show running-config section dot1x\\n   dot1x system-auth-control\\n   dot1x dynamic-authorization\\n   ...\\n   interface Ethernet1\\n      dot1x pae authenticator\\n      dot1x port-control auto\\n\\nAuthenticated 802.1X sessions can be listed with:\\nswitch#show dot1x hosts\\n   Port Supplicant MAC Username Auth State Fallback VLAN VLAN Name\\n   Et30 0017.0100.0001 00:17:01:00:00:01 MBA SUCCESS NONE 30* VLAN0030\\n   Et30 606b.5ba7.73c5 60:6b:5b:a7:73:c5 MBA SUCCESS NONE 30* VLAN0030\\n\\n2. RADIUS proxy must be enabled with dynamic authorization\\nThe running configuration contains a radius proxy section with at least one client group and the dynamic-authorization command:\\nswitch# show running-config section radius proxy\\n   radius proxy\\n      dynamic-authorization\\n      client group CG1\\n         client ipv4 10.0.0.0/24 vrf default\\n         server group SG1\\n\\nThe state of the RADIUS proxy feature can be confirmed with:\\nswitch# show radius proxy client group\\n   Radius Client Group : CG1\\n   Last time counters were cleared : never\\n   Dynamic authorization : enabled\\n   Dynamic authorization destination port : \u003cportNumber\u003e\\n      Client : \u003cclientName\u003e, authentication port 1812, accounting port 1813, vrf default\\n      Resolved IP address : \u003cresolvedIp\u003e\\n   \\u2026\\n\\nIf the output of this command shows \\\"Dynamic authorization: disabled\\\", or if either the radius proxy section or the 802.1X configuration above is absent, there is no exposure to the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cpre\u003e\\nIn order to be vulnerable to CVE-2026-73449, both of the following conditions must be met:\\n1. 802.1X must be enabled with RADIUS dynamic authorization\\nThe running configuration must contain dot1x system-auth-control and dot1x dynamic-authorization, with one or more interfaces configured for authentication:\\nswitch# show running-config section dot1x\\n   dot1x system-auth-control\\n   dot1x dynamic-authorization\\n   ...\\n   interface Ethernet1\\n      dot1x pae authenticator\\n      dot1x port-control auto\\n\\nAuthenticated 802.1X sessions can be listed with:\\nswitch#show dot1x hosts\\n   Port Supplicant MAC Username Auth State Fallback VLAN VLAN Name\\n   Et30 0017.0100.0001 00:17:01:00:00:01 MBA SUCCESS NONE 30* VLAN0030\\n   Et30 606b.5ba7.73c5 60:6b:5b:a7:73:c5 MBA SUCCESS NONE 30* VLAN0030\\n\\n2. RADIUS proxy must be enabled with dynamic authorization\\nThe running configuration contains a radius proxy section with at least one client group and the dynamic-authorization command:\\nswitch# show running-config section radius proxy\\n   radius proxy\\n      dynamic-authorization\\n      client group CG1\\n         client ipv4 10.0.0.0/24 vrf default\\n         server group SG1\\n\\nThe state of the RADIUS proxy feature can be confirmed with:\\nswitch# show radius proxy client group\\n   Radius Client Group : CG1\\n   Last time counters were cleared : never\\n   Dynamic authorization : enabled\\n   Dynamic authorization destination port : \u0026lt;portNumber\u0026gt;\\n      Client : \u0026lt;clientName\u0026gt;, authentication port 1812, accounting port 1813, vrf default\\n      Resolved IP address : \u0026lt;resolvedIp\u0026gt;\\n   \\u2026\\n\\nIf the output of this command shows \\\"Dynamic authorization: disabled\\\", or if either the radius proxy section or the 802.1X configuration above is absent, there is no exposure to the issue.\\n\u003c/pre\u003e\"}]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If the RADIUS proxy dynamic authorization function is not operationally required, disabling it removes the exposure. Please note this operation will stop the switch from forwarding CoA and Disconnect requests to downstream RADIUS proxy clients. Dynamic authorization of the switch\u0027s own local 802.1X sessions continues to work.\\n\\nswitch(config)# radius proxy\\nswitch(config-radius-proxy)# no dynamic-authorization\\n\\nIf RADIUS proxy dynamic authorization must remain enabled, the exposure window can be reduced (but not eliminated) by lowering the proxy client session idle timeout from its default of 600 seconds:\\n\\nswitch(config)# radius proxy\\nswitch(config-radius-proxy)# client session idle-timeout \u003cseconds\u003e seconds\\n\\nNote that if the idle-timeout is being reduced, then radius proxy clients should increase the frequency of interim-update accounting requests. For more information about idle-timeout configuration see \\u201cConfiguring session idle-timeout\\u201d section in RADIUS Proxy.\\nIf a specific endpoint must be forcibly disconnected while this issue is unresolved, the following command can be used.\\n\\nswitch(config)# clear dot1x host mac \u003cendpoint macAddress\u003e\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cpre\u003e\\nIf the RADIUS proxy dynamic authorization function is not operationally required, disabling it removes the exposure. Please note this operation will stop the switch from forwarding CoA and Disconnect requests to downstream RADIUS proxy clients. Dynamic authorization of the switch\u0027s own local 802.1X sessions continues to work.\\n\\nswitch(config)# radius proxy\\nswitch(config-radius-proxy)# no dynamic-authorization\\n\\nIf RADIUS proxy dynamic authorization must remain enabled, the exposure window can be reduced (but not eliminated) by lowering the proxy client session idle timeout from its default of 600 seconds:\\n\\nswitch(config)# radius proxy\\nswitch(config-radius-proxy)# client session idle-timeout \u0026lt;seconds\u0026gt; seconds\\n\\nNote that if the idle-timeout is being reduced, then radius proxy clients should increase the frequency of interim-update accounting requests. For more information about idle-timeout configuration see \\u201cConfiguring session idle-timeout\\u201d section in RADIUS Proxy.\\nIf a specific endpoint must be forcibly disconnected while this issue is unresolved, the following command can be used.\\n\\nswitch(config)# clear dot1x host mac \u0026lt;endpoint macAddress\u0026gt;\\n\u003c/pre\u003e\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\\nCVE-2026-73449 has been fixed in the following releases:\\n- 4.36.2F and later releases in the 4.36.x train\\n- 4.35.6M and later releases in the 4.35.x train\\n- 4.34.8M and later releases in the 4.34.x train\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cpre\u003e\\nThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\\nCVE-2026-73449 has been fixed in the following releases:\\n- 4.36.2F and later releases in the 4.36.x train\\n- 4.35.6M and later releases in the 4.35.x train\\n- 4.34.8M and later releases in the 4.34.x train\\n\u003c/pre\u003e\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\", \"type\": \"finder\"}], \"source\": {\"defect\": [\"1697784\"], \"advisory\": \"149\", \"discovery\": \"INTERNAL\", \"defects\": [\"BUG 1697784\"]}, \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV3_1\": {\"version\": \"3.1\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"baseSeverity\": \"MEDIUM\", \"baseScore\": 5.9, \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L\"}}, {\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV4_0\": {\"attackVector\": \"ADJACENT\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subIntegrityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"NONE\", \"subAvailabilityImpact\": \"LOW\", \"exploitMaturity\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"version\": \"4.0\", \"baseSeverity\": \"MEDIUM\", \"baseScore\": 5.9, \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L\"}}]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73449\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T19:11:42.553584Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T19:11:47.643Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73449\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Arista\", \"dateReserved\": \"2026-08-12T16:42:47.921Z\", \"datePublished\": \"2026-09-14T21:57:39.220Z\", \"dateUpdated\": \"2026-09-15T19:11:51.208Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.