Paper/Archive/CVE-2024-27890

CVE-2024-27890

Arista Networks EOS — On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).

EPSS 4%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 91.4.914 × 2018.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

Affected

ProductAffectedFixed inSource

EOS4.29.0 – 4.29.7M–CNA

EOS4.28.0 – 4.28.10M–CNA

EOS4.27.0 – 4.27.8M–CNA

EOS4.26.0 – 4.26.9M–CNA

EOS4.25.0 – 4.25.10M–CNA

EOS4.24.0 – 4.24.11M–CNA

Scores by source

Arista (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Arista (CNA)7.2CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refarista.com/en/support/advisories-notices/security-advisory/19862-security-advisory-0099