CVE Catalog
CVE-2024-27890
CriticalCVSS 9.6Exploitation Probability (EPSS)
Very high risk4.43%
90th percentile - higher than 90% of all known CVEs
Summary
Platforms running Arista EOS with OpenConfig configured may accept gNMI Set requests that should have been rejected, leading to unexpected configuration changes on the switch.
Risk Assessment
Unauthorized configuration changes can disrupt network operations, cause outages, or violate security policies.
Recommendation
Review OpenConfig configuration and apply appropriate filtering rules for gNMI Set requests, and update EOS to a patched version.
Original NVD description (English source)
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.