Riskcovery

CVE-2024-8000

On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restar

State
Published
Severity
5.3 Medium
Published
Mar 4, 2025
Updated
Mar 4, 2025
Reserved
Aug 19, 2024

Read the record on cve.org

Description

On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in only the first line of the ACL being installed after an Accelerated Software Upgrade (ASU) restart.

Note: supplicants with pending captive-portal authentication during ASU would be impacted with this bug.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NArista

Weaknesses

  • CWE-1284 Improper Validation of Specified Quantity in Input

Affected Products

ProductVersions
EOSArista Networks
  • 4.32.0 through 4.32.4MAffected
  • 4.31.0 through 4.31.5MAffected
  • 4.30.0 through 4.30.8MAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.