In Arista’s EOS, when 802.1X is enabled with multi‑auth mode, unauthenticated hosts on a switch port may be granted traffic access if an EAPOL capable device exists in the fallback VLAN. This flaw allows an attacker to bypass authentication and obtain network connectivity, potentially exposing internal resources. The weakness stems from improper handling of port authorization state and is classified under CWE‑1287.

Arista Networks EOS devices are affected. The vulnerability applies to all releases prior to the patched versions. Update to EOS 4.31.2F or newer in the 4.31.x train, EOS 4.30.6M or newer in the 4.30.x train, EOS 4.29.8M or newer in the 4.29.x train, and EOS 4.28.11M or newer in the 4.28.x train to resolve the issue. Other older or unreleased firmware versions are also affected until patched.

Because the attack requires an EAPOL device in the fallback VLAN, it is most likely exploitable by an adversary with network connectivity or who can introduce a device into that VLAN. The EPSS score is 0.00176, indicating a very low probability of exploitation. The CVSS base score is 6.5, classifying the flaw as moderate severity. The vulnerability is not listed in the CISA KEV catalog. While the low EPSS suggests limited real‑world exploitation, the moderate CVSS indicates that, if exploited, an attacker could gain unauthorized network access and potentially move laterally within the environment.