Arista Networks EOS 4.36.1F Multiple Vulnerabilities (SA0150)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346256);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-75944", "CVE-2026-75945");
  script_xref(name:"IAVA", value:"2026-A-0986");

  script_name(english:"Arista Networks EOS 4.36.1F Multiple Vulnerabilities (SA0150)");

  script_set_attribute(attribute:"synopsis", value:
"The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities as referenced
in security advisory SA0150.

  - On Arista EOS 4.36.1F configured as an 802.1X authenticator with per-supplicant access control lists, an
    adjacent attacker can trigger an unexpected condition that results in a denial of service on the affected
    device. (CVE-2026-75944)

  - On Arista EOS 4.36.1F configured as an 802.1X authenticator with per-supplicant access control lists, the
    access control list assigned to an authenticated supplicant may not be enforced as intended, allowing an
    adjacent attacker to send traffic that should have been denied. (CVE-2026-75945)

Note that Nessus has not checked the 802.1X authenticator and per-supplicant ACL configuration required for
exposure and has instead relied only on the application's self-reported version number.");
  # https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4f5cda50");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Arista Networks EOS 4.36.2F or later, or apply the mitigation referenced in the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:S/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-75945");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-75944");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/16");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:arista:eos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("arista_eos_detect.nbin");
  script_require_keys("Host/Arista-EOS/Version", "Settings/ParanoidReport");

  exit(0);
}

include('arista_eos_func.inc');
include('audit.inc');

# Exposure requires EOS to be configured as an 802.1X authenticator with per-supplicant ACLs. That configuration
# cannot be confirmed from the version alone, so require paranoid reporting.
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var version = get_kb_item_or_exit('Host/Arista-EOS/Version');

# SA0150 lists the AWE 5000 and AWE 7200R series, CloudEOS, cEOS-lab, vEOS-lab and CloudVision eXchange as NOT
# affected; the vulnerability applies to the physical switch platforms only. The model KB is best-effort (it is
# derived from the startup-config or /etc/prefdl), so only gate when it is actually available -- otherwise the
# version check still applies.
var model = get_kb_item('Host/Arista-EOS/model');
if (!empty_or_null(model))
{
  model = toupper(model);
  if (model =~ "AWE-?5[0-9]{3}" || model =~ "AWE-?7[0-9]{3}R" || model =~ "CLOUDEOS" || model =~ "CEOS" ||
      model =~ "VEOS" || model =~ "CVX")
    audit(AUDIT_HOST_NOT, 'an affected model');
}

var vmatrix = make_array();

# Affected Software, per SA0150 for CVE-2026-75944 and CVE-2026-75945. Unlike the other CVEs in the same advisory,
# these two are documented against 4.36.1F only -- no earlier train and no other release is listed -- so an exact
# string match is used rather than a range.
vmatrix['misc'] = make_list('4.36.1F');
vmatrix['fix']  = '4.36.2F';

if (eos_is_affected(vmatrix:vmatrix, version:version))
  security_report_v4(severity:SECURITY_NOTE, port:0, extra:eos_report_get());
else
  audit(AUDIT_INST_VER_NOT_VULN, 'Arista Networks EOS', version);