Arista EOS: MACsec authentication secrets written to diagnostic data during Smart System Upgrade

CVSS 7.0CVE-2026-120976Firmware, BMC & network fabriccurated

Impact

On switches running 802.1X with MACsec using dynamically derived keys, a Smart System Upgrade (SSU) reload with an active 802.1X/MACsec session can record sensitive authentication information in diagnostic data. Anyone who obtains that data can recover the secret and compromise the confidentiality and integrity of the MACsec-protected link. Diagnostic bundles are often copied off the switch and shared with support teams, so the data can travel further than the switch itself. The exposure exists only during and after an SSU reload with such a session present.

Who can reach it

Someone with administrative access on the switch, or anyone who later obtains the affected diagnostic data. The device must have run an SSU reload while an 802.1X session used for MACsec was active.

What to do

Upgrade EOS to a fixed release according to Arista Security Advisory 0216. The record does not list versions. On switches that have already done an SSU reload with active 802.1X/MACsec sessions, restrict and purge the diagnostic data that was collected, and treat the MACsec keys on those links as possibly exposed.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-120976 https://www.arista.com/en/support/advisories-notices/security-advisory/25038-security-advisory-0216

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.