Unauthorized gNMI Set Request in Arista EOS with OpenConfig

Publication date: 2026-06-04

Last updated on: 2026-06-04

Assigner: Arista Networks, Inc.

Description

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-04

Last Modified

2026-06-04

Generated

2026-07-15

AI Q&A

2026-06-05

EPSS Evaluated

2026-07-14

NVD

CVE-2024-27890

EUVD

EUVD-2024-55612

Affected Vendors & Products

Vendor	Product	Version / Range
arista	arista_eos	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects platforms running Arista EOS with OpenConfig configured. It allows a gNMI Set request to be executed when it should have been rejected, which means that unexpected configuration changes can be applied to the switch.

Impact Analysis

The vulnerability can lead to unauthorized or unexpected configuration changes on the affected network switch. This can impact the integrity and availability of the network device, potentially causing disruptions or allowing malicious configuration that harms network operations.

Hi! I’m here to help you understand CVE-2024-27890. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70