gNMI Set Request Bypass in Arista EOS

Publication date: 2026-06-04

Last updated on: 2026-06-04

Assigner: Arista Networks, Inc.

Description

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-04

Last Modified

2026-06-04

Generated

2026-07-15

AI Q&A

2026-06-05

EPSS Evaluated

2026-07-14

NVD

CVE-2024-27892

EUVD

EUVD-2024-55613

Affected Vendors & Products

Vendor	Product	Version / Range
arista	arista_eos	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects platforms running Arista EOS with OpenConfig configured. It allows a gNMI Set request to be executed when it should have been rejected, which means that unexpected configuration changes can be applied to the switch.

Impact Analysis

The vulnerability can lead to unauthorized or unexpected configuration changes on affected network switches. This can disrupt network operations, potentially causing outages or degraded performance, and may allow attackers to manipulate network behavior.

Hi! I’m here to help you understand CVE-2024-27892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70