Vulnerability · Published Jun 4, 2026 · Assigned by Arista
CVE-2023-5502On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.
Medium 5.9
In plain English
A medium-severity improper authentication in EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 75.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | EOS | 4.31.0 – through 4.31.0F4.30.0 – through 4.30.4M4.29.0 – through 4.29.6M4.28.0 – through 4.28.8M4.27.0 – through 4.27.11M4.26.0 – through 4.26.11M4.25.0 – through 4.25.11M4.24.0 – through 4.24.11M |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N