MACsec and Egress ACL Bypass in Arista EOS

Publication date: 2026-06-04

Last updated on: 2026-06-04

Assigner: Arista Networks, Inc.

Description

On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-04

Last Modified

2026-06-04

Generated

2026-07-15

AI Q&A

2026-06-05

EPSS Evaluated

2026-07-14

NVD

CVE-2024-27891

EUVD

EUVD-2024-55611

Affected Vendors & Products

Vendor	Product	Version / Range
arista	arista_eos	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability occurs on Arista EOS platforms when MACsec and egress ACLs are configured on the same interfaces. Due to this issue, the ACL policies may not be properly enforced on outgoing packets, meaning that packets leaving the affected ports might be incorrectly allowed or denied.

Impact Analysis

The impact of this vulnerability is that network security policies enforced by egress ACLs may not function correctly. This can lead to unauthorized data being sent out or legitimate data being blocked, potentially causing security breaches or disruptions in network communication.

Hi! I’m here to help you understand CVE-2024-27891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70