A malicious supplicant can bypass the 802.1x authentication requirement on Arista EOS devices that have 802.1x enabled on access or trunk ports and routing activated on the access VLAN. The flaw permits the unauthorized network access of the attacker without completing the 802.1x authentication handshake, effectively compromising the integrity of the network boundary. The weakness is a classic authentication bypass, classified as CWE-287.

Arista Networks EOS running on the 4.32.0F and later releases of the 4.32.x train, 4.31.3M and later of the 4.31.x train, 4.30.5M and later of the 4.30.x train, and 4.29.7M and later of the 4.29.x train are vulnerable. Devices on the 7280E and 7500E platforms are end-of-life and do not have a released version that addresses this issue. The vulnerability impacts any configuration where 802.1x authentication is active on access or trunk ports with routing enabled on the associated access VLAN.

The CVSS score of 8.2 indicates high severity, and the absence of an EPSS value suggests that current exploitation evidence is limited. The issue is not listed in CISA's KEV catalog. A likely attack vector requires an attacker to act as a legitimate supplicant on the network, leveraging the device's routing capabilities on the access VLAN. Because the flaw allows locally authenticated transit of traffic without proper authentication, the risk to network confidentiality and integrity is substantial, and mitigation should occur promptly.