CVE-2024-27892

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/19862-security-advisory-0099

Configurations

No configuration.

History

22 Jul 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Plataformas afectadas que ejecutan Arista EOS con OpenConfig configurado, una solicitud gNMI Set puede ejecutarse cuando debería haber sido rechazada. Esto puede resultar en que se aplique una configuración inesperada al switch.

04 Jun 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-04 23:16

Updated : 2026-07-22 20:10

NVD link : CVE-2024-27892

Mitre link : CVE-2024-27892

CVE.ORG link : CVE-2024-27892

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2024-27892", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27892", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-05T18:30:07.883215Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@arista.com", "affectedData": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.31.0", "versionType": "custom", "lessThanOrEqual": "4.31.2F"}, {"status": "affected", "version": "4.30.0", "versionType": "custom", "lessThanOrEqual": "4.30.5M"}, {"status": "affected", "version": "4.29.0", "versionType": "custom", "lessThanOrEqual": "4.29.7M"}, {"status": "affected", "version": "4.28.0", "versionType": "custom", "lessThanOrEqual": "4.28.10M"}, {"status": "affected", "version": "4.27.0", "versionType": "custom", "lessThanOrEqual": "4.27.8M"}, {"status": "affected", "version": "4.26.0", "versionType": "custom", "lessThanOrEqual": "4.26.9M"}, {"status": "affected", "version": "4.25.0", "versionType": "custom", "lessThanOrEqual": "4.25.10M"}, {"status": "affected", "version": "4.24.0", "versionType": "custom", "lessThanOrEqual": "4.24.11M"}], "platforms": ["710 Series", "720D Series", "720XP/722XPM Series", "750X Series", "7010 Series", "7010X Series", "7020R Series", "7130 Series running EOS", "7150 Series", "7160 Series", "7170 Series", "7050X/X2/X3/X4 Series", "7060X/X2/X4/X5/X6 Series", "7250X Series", "7260X/X3 Series", "7280E/R/R2/R3 Series", "7300X/X3 Series", "7320X Series", "7358X4 Series", "7368X4 Series", "7388X5 Series", "7500E/R/R2/R3 Series", "7800R3 Series", "CloudEOS", "cEOS-lab", "vEOS-lab", "AWE 5000 Series"], "defaultStatus": "unaffected"}]}], "published": "2026-06-04T23:16:48.117", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19862-security-advisory-0099", "source": "psirt@arista.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@arista.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch."}, {"lang": "es", "value": "Plataformas afectadas que ejecutan Arista EOS con OpenConfig configurado, una solicitud gNMI Set puede ejecutarse cuando deber\u00eda haber sido rechazada. Esto puede resultar en que se aplique una configuraci\u00f3n inesperada al switch."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "psirt@arista.com"}