« Volver al listado

CVE-2023-5502

Estado: Pendiente de análisisAlta (8.2)—

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Bypass de autenticación 802.1x en dispositivos Arista EOS accesibles en red sin privilegios previos (AV:N, PR:N). El atacante malintencionado elude la validación de credenciales (CWE-287) para obtener acceso a la red.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Arista — EOSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-5502",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-5502",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-05T18:30:41.122247Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@arista.com",
      "affectedData": [
        {
          "vendor": "Arista Networks",
          "product": "EOS",
          "versions": [
            {
              "status": "affected",
              "version": "4.31.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.31.0F"
            },
            {
              "status": "affected",
              "version": "4.30.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.30.4M"
            },
            {
              "status": "affected",
              "version": "4.29.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.29.6M"
            },
            {
              "status": "affected",
              "version": "4.28.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.28.8M"
            },
            {
              "status": "affected",
              "version": "4.27.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.27.11M"
            },
            {
              "status": "affected",
              "version": "4.26.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.26.11M"
            },
            {
              "status": "affected",
              "version": "4.25.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.25.11M"
            },
            {
              "status": "affected",
              "version": "4.24.0",
              "versionType": "custom",
              "lessThanOrEqual": "4.24.11M"
            }
          ],
          "platforms": [
            "7020R Series",
            "7280R/R2 Series",
            "7500R/R2 Series",
            "7280E Series",
            "7500E Series"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-04T23:16:47.210",
  "references": [
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19462-security-advisory-0096",
      "source": "psirt@arista.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@arista.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication."
    },
    {
      "lang": "es",
      "value": "En plataformas afectadas que ejecutan Arista EOS con autenticación 802.1x configurada en los puertos de acceso/troncal, y enrutamiento habilitado en la VLAN de acceso de los puertos, un suplicante malicioso podría ser capaz de eludir el requisito de realizar autenticación 802.1x."
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "sourceIdentifier": "psirt@arista.com"
}