Arista Networks EOS 802.1X Per-Supplicant ACL Bypass (SA0150) (CVE-2026-75943)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346258);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/16");

  script_cve_id("CVE-2026-75943");

  script_name(english:"Arista Networks EOS 802.1X Per-Supplicant ACL Bypass (SA0150) (CVE-2026-75943)");

  script_set_attribute(attribute:"synopsis", value:
"The version of Arista Networks EOS running on the remote device is affected by an access control bypass
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Arista Networks EOS running on the remote device is affected by an access control bypass vulnerability
as referenced in security advisory SA0150.

  - On affected releases of Arista EOS configured as an 802.1X authenticator with per-supplicant access control
    lists, traffic from an authenticated supplicant may bypass the access control list assigned to that
    supplicant, allowing an adjacent attacker to send traffic that should have been denied. (CVE-2026-75943)

Note that Nessus has not checked the 802.1X authenticator and per-supplicant ACL configuration required for
exposure and has instead relied only on the application's self-reported version number.");
  # https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4f5cda50");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Arista Networks EOS 4.33.10M / 4.34.8M / 4.35.6M / 4.36.2F or later, or apply the mitigation referenced in
the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:S/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-75943");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/16");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:arista:eos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("arista_eos_detect.nbin");
  script_require_keys("Host/Arista-EOS/Version", "Settings/ParanoidReport");

  exit(0);
}

include('arista_eos_func.inc');
include('audit.inc');

# Exposure requires EOS to be configured as an 802.1X authenticator with per-supplicant ACLs. That configuration
# cannot be confirmed from the version alone, so require paranoid reporting.
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var version = get_kb_item_or_exit('Host/Arista-EOS/Version');

# SA0150 lists the AWE 5000 and AWE 7200R series, CloudEOS, cEOS-lab, vEOS-lab and CloudVision eXchange as NOT
# affected; the vulnerability applies to the physical switch platforms only. The model KB is best-effort (it is
# derived from the startup-config or /etc/prefdl), so only gate when it is actually available -- otherwise the
# version check still applies.
var model = get_kb_item('Host/Arista-EOS/model');
if (!empty_or_null(model))
{
  model = toupper(model);
  if (model =~ "AWE-?5[0-9]{3}" || model =~ "AWE-?7[0-9]{3}R" || model =~ "CLOUDEOS" || model =~ "CEOS" ||
      model =~ "VEOS" || model =~ "CVX")
    audit(AUDIT_HOST_NOT, 'an affected model');
}

var vmatrix = make_array();

# Affected Software, per SA0150 for CVE-2026-75943. The advisory names 4.36.1F, 4.35.5M, 4.34.7.1M and 4.33.9M as the
# last affected releases of their respective trains, and all releases prior to 4.33 are affected in their entirety.
# The caps are extended with .9999 so intra-release maintenance builds below the named fix remain in range.
vmatrix['all'] = make_list('0.0<=4.32.9999',
                           '4.33.0<=4.33.9.9999',
                           '4.34.0<=4.34.7.9999',
                           '4.35.0<=4.35.5.9999',
                           '4.36.0<=4.36.1.9999');
vmatrix['fix'] = '4.33.10M / 4.34.8M / 4.35.6M / 4.36.2F';

if (eos_is_affected(vmatrix:vmatrix, version:version))
  security_report_v4(severity:SECURITY_NOTE, port:0, extra:eos_report_get());
else
  audit(AUDIT_INST_VER_NOT_VULN, 'Arista Networks EOS', version);