CVE-2026-73449 in EOS
Summary
by MITRE • 09/15/2026
On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network. Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The described vulnerability affects Arista EOS platforms where 802.1X port authentication is enabled alongside a RADIUS proxy configured for dynamic authorization capabilities. This specific configuration creates an environment where network access control relies on real-time communication between the Network Access Server and external RADIUS servers to enforce security policies, particularly through Change-of-Authorization messages or Disconnect-Requests as defined in RFC 5176. The core technical flaw lies in how the device processes incoming RADIUS packets from a configured proxy client when subjected to induced traffic by an attacker on an adjacent network segment. By manipulating these packets, a low-privileged adversary can disrupt the delivery of critical dynamic authorization commands intended for locally authenticated sessions. This disruption effectively creates a blind spot where the enforcement mechanism fails to apply state changes mandated by the central authentication server.
The operational impact of this flaw is significant within enterprise networks that depend on centralized policy management and real-time session termination. When an administrator or automated security system determines that a device poses a threat, it typically issues a Disconnect-Request via RADIUS CoA to immediately revoke network access without requiring physical intervention at the switch port. Due to this vulnerability, such commands are prevented from being applied to the targeted sessions. Consequently, endpoints that have been ordered for disconnection remain authorized and active on the network. This persistence allows potentially compromised devices to continue exfiltrating data, launching lateral movement attacks, or maintaining persistent access despite explicit administrative orders to sever their connection. The security posture is severely degraded because the automated response mechanisms designed to contain threats are rendered ineffective by this bypass technique.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-754 Improper Check for Unusual or Exceptional Conditions within the context of protocol handling. The attacker exploits the lack of rigorous validation on incoming RADIUS packets to interfere with internal state management logic. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1071 Application Layer Protocol specifically involving RADIUS abuse and potentially T1562 Impair Defenses through disruption of security services. The attack vector requires the attacker to be on an adjacent network segment capable of reaching the configured RADIUS proxy client, indicating that while it is a remote exploit in terms of protocol interaction, it relies on local network reachability which may limit its applicability in strictly segmented environments but remains critical for flat or poorly segmented internal networks.
Mitigation strategies must focus on both configuration hardening and network segmentation to reduce the attack surface. The primary recommendation is to disable dynamic authorization features such as RADIUS proxy with CoA support if they are not strictly necessary for the specific operational requirements of the deployment. If these features are essential, administrators should implement strict access control lists that restrict which IP addresses can send RADIUS packets to the proxy client interface, ensuring only trusted authentication servers have communication rights. Additionally, enabling logging and monitoring for anomalous RADIUS traffic patterns can help detect attempted exploitation in real time. Since Arista has confirmed no known malicious exploitation in customer networks, immediate patching is advised based on risk tolerance, but implementing network-level restrictions provides an effective compensating control to mitigate the impact of this flaw until software updates are applied.