On Arista EOS platforms with 802.1X port authentication and RADIUS proxy configured with dynamic authorization, an attacker with low privileges on an adjacent network segment can send crafted RADIUS packets via a configured RADIUS proxy client. This prevents dynamic authorization messages, including CoA and Disconnect-Requests as per RFC 5176, from being applied to locally authenticated 802.1X sessions. Consequently, sessions that the RADIUS server or network access control system intends to disconnect remain active and authorized. The vulnerability requires explicit configuration of both 802.1X with dynamic authorization and RADIUS proxy with dynamic authorization. It was discovered internally by Arista, with no known exploitation in the wild.

An attacker can prevent disconnection of endpoint sessions that should be terminated by the RADIUS server or network access control system, potentially allowing unauthorized network access to persist. The confidentiality impact is low, integrity impact is high due to unauthorized session persistence, and availability impact is low. The attack requires adjacency and low privileges, and the configuration must include both 802.1X with dynamic authorization and RADIUS proxy with dynamic authorization.

No official patch or fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation requires verifying the configuration of 802.1X port authentication and RADIUS proxy with dynamic authorization and applying any vendor updates once available. Monitor vendor communications for patches or recommended configuration changes.