Arista EOS: spoofed DHCP packet fakes a device profile and puts a host on a privileged segment

CVSS 7.1CVE-2026-120977Firmware, BMC & network fabriccurated

Impact

On switches running 802.1X with DHCP device profiling, a nearby attacker sends a crafted DHCP packet and the switch records a fake device profile. An already-authenticated supplicant can then get onto a network segment with more privileges than it should have. That breaks the network separation 802.1X is meant to enforce, for example between management and tenant networks. Only switches with both 802.1X and DHCP profiling enabled are affected. That combination is far more common at the campus access edge than in GPU fabrics.

Who can reach it

Network-adjacent attacker able to send DHCP to a port with 802.1X and DHCP profiling enabled. The escalation is gained by an authenticated supplicant.

What to do

Follow Arista Security Advisory 0217 for the affected and fixed EOS releases. Upgrading EOS means installing a new image and reloading the switch. If you do not use DHCP device profiling, the exposure does not apply.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-120977 https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.