The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2023-5502 has been fixed in the following releases: * 4.32.0F and later releases in the 4.32.x train * 4.31.3M and later releases in the 4.31.x train * 4.30.5M and later releases in the 4.30.x train * 4.29.7M and later releases in the 4.29.x train Note: Products 7280E and 7500E are EOL, and there are no released versions of EOS which fix the issue on those platforms.

In order to be vulnerable to CVE-2023-5502, either of the following configuration conditions must be met: Condition 1: Dot1x authentication must be configured: dot1x system-auth-control interface Ethernet1 dot1x pae authenticator dot1x port-control auto !! One of the two configuration lines below MUST be set dot1x host-mode single-host dot1x host-mode multi-host authenticated interface Vlan100 ip address 1.1.1.1/24 ip routing Condition 2: 802.1x configured in any host mode with MBA: dot1x system-auth-control interface Ethernet1 dot1x pae authenticator dot1x port-control auto dot1x mac based authentication !! One of the three configuration lines below MUST be set dot1x host-mode single-host dot1x host-mode multi-host authenticated dot1x host-mode multi-host interface Vlan100 ip address 1.1.1.1/24 ip routing

Mitigation of this vulnerability requires disabling dot1x. Dot1x can be disabled globally using the following command: no dot1x system-auth-control