CVE-2024-8000

MEDIUM5.3

On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar

Published Mar 4, 2025

Modified 1 years ago

Details

On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart.

Note: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.

References

WEB

https://www.arista.com/en/support/advisories-notices/security-advisory/21086-security-advisory-0109

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-8000

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector

AdjacentAV:A

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

HighI:H

Availability

NoneA:N

5.3/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness Type (CWE)

Other

CWE-1284

Ecosystems

Timeline

PublishedMar 4, 2025

ModifiedMar 4, 2025