This vulnerability involves a race condition in Arista Networks EOS versions 4.36.0 through 4.36.1F. When the 'clear dot1x host all' command is executed, a supplicant may remain in an authorized state due to incomplete cleanup of authorization information. The CVSS 3.1 base score is 2.6, indicating low severity, with low impact on integrity and no impact on confidentiality or availability. The attack vector is adjacent network, requiring high attack complexity and low privileges, with no user interaction needed.

The impact is limited to a potential integrity issue where a supplicant remains authorized after a command intended to clear authorization states. There is no impact on confidentiality or availability. This could allow continued network access by a device that should have been deauthorized, but exploitation requires specific conditions and is of low severity.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of the potential for incomplete cleanup when using the 'clear dot1x host all' command and consider operational controls accordingly.