Arista EOS: Improper access control in 802.1X multi-host mode with PBR

Summary

On Arista EOS switches where 802.1X is configured in multi-host authenticated mode and Policy Based Routing (PBR) is configured, traffic from unauthenticated hosts may be forwarded to the PBR destination. An attacker on the local network segment could thereby gain access to networks they should not reach. Layer 2 and Layer 3 control packets from unauthenticated hosts may also be copied to the CPU.

Affected

• EOS from 1.0.0 before 4.33.0F
• EOS 4.33.0F through 4.33.9M
• EOS 4.34.0F through 4.34.7M
• EOS 4.35.0F through 4.35.5M
• EOS 4.36.0F through 4.36.1F
• Only relevant where 802.1X multi-host authenticated mode and PBR are both configured (default configuration is unaffected)

Fixed in

Unknown. Check the Arista advisory for the authoritative list of fixed builds. Sibling advisories suggest 4.33.10M, 4.34.8M, 4.35.6M and 4.36.2F may be the first builds outside the affected ranges, but this is unconfirmed.

Workaround

• Configure the PBR policy with specific, trusted address ranges instead of broad match rules (for example 'permit ip any any').
• Unknown whether further vendor workarounds exist; verify in the advisory.

Exploitation

• Nothing known. No in-the-wild exploitation or public proof-of-concept reported.
• CVSS 4.0 base score 6.1 (Medium), attack vector Adjacent, no privileges and no user interaction required.

Our recommendation

• Check whether affected EOS trains are running and whether 802.1X multi-host mode and PBR are both configured on the switches.
• If both are present, restrict PBR match rules to trusted address ranges now and plan an upgrade to the fixed build named in the vendor advisory.
• Ensure the switches are not exposed directly to the internet and monitor for unexpected traffic on guest or BYOD networks.
• Priority is low to medium for most SMEs and higher where 802.1X and PBR are used on guest or BYOD networks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Arista Security Advisory 0215 www.arista.com
• CVE Record CVE-2026-120983 www.cve.org
• Strix CVE-2026-120983 www.strix.ai
• Arista 802.1X Trouble Office Information www.arista.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:17.