Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-6858

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

Medium6.5EPSS 0.14%
Published
Updated
Reserved
Assigned by
Arista

Description

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

Timeline

  1. ID reserved

    By Arista

  2. · 23 months later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-6858, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1Medium6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVDNVD · Awaiting Analysis3.1Medium6.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
0.14% · top 96% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

  • Arista Networks · EOS

    • affected 4.31.0 – ≤ 4.31.1F
    • affected 4.30.0 – ≤ 4.30.5M
    • affected 4.29.0 – ≤ 4.29.7M
    • affected 4.28.10 – ≤ 4.28.10.1M

What to do

Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see  EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-6858 has been fixed in the following releases: * 4.31.2F and later releases in the 4.31.x train. * 4.30.6M and later releases in the 4.30.x train. * 4.29.8M and later releases in the 4.29.x train. * 4.28.11M and later releases in the 4.28.x train.

Workaround: This vulnerability arises when there is an EAPOL supplicant in any of the fallback VLAN’s ( i.e. auth-fail, unresponsive VLAN ). If only unauthenticated EAPOL supplicants are expected the admin can change dot1x host-mode to single-host as indicated below. switch(config-if-et1)#dot1x host-mode single-host * Dot1x Host Mode * Single Host Mode: Please note when once the 802.1X supplicant is authenticated on the port, ONLY the traffic coming from the supplicant's MAC is allowed through the port. * Multi-Host Mode: Once the 802.1X supplicant is authenticated on the port, traffic coming from ANY source MAC is allowed through the port. * Multi-Host authenticated Mode: Multiple 802.1X supplicants can be allowed and ONLY the traffic coming from all authenticated supplicant’s MAC is allowed through the port.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-6858 badge
[![CVE-2024-6858](https://trackcve.app/badge/CVE-2024-6858.svg)](https://trackcve.app/cve/CVE-2024-6858)

Record last updated .