CVE-2024-27891
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
Risk Assessment
Outgoing packets may be incorrectly allowed or denied, potentially leading to violation of network security policies.
Recommendation
Update Arista EOS to a patched version or modify configuration to avoid using MACsec and ACLs on the same interfaces.
Other vulnerabilities in Arista EOS
See all- CVE-2015-8236High
Arista EOS versions before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allow remote attackers to execute arbitrary code as root by leveraging management-plane access.
- CVE-2026-7473MediumActively exploited
On affected platforms running Arista EOS, a tunnel decapsulation configuration, such as VXLAN, decap-groups, or a GRE tunnel interface, may lead to incorrect decapsulation and forwarding of other unexpected tunneled packets. This issue arises from the switch's failure to verify the tunnel protocol type.
- CVE-2024-27892Critical
On platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
- CVE-2024-27890Critical
Platforms running Arista EOS with OpenConfig configured may accept gNMI Set requests that should have been rejected, leading to unexpected configuration changes on the switch.
- CVE-2025-8873High
Vulnerability in Arista EOS with IPsec configured. A specially crafted packet can stop all IPsec traffic processing in the dataplane. After reset, traffic may not resume. Non-IPsec traffic is unaffected.
- CVE-2023-5502Medium
On platforms running Arista EOS with 802.1x authentication configured on access/trunk ports and routing enabled on the access VLAN, a malicious supplicant may bypass the requirement to perform 802.1x authentication.
- CVE-2024-6858Medium
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
- CVE-2023-3646Medium
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.
Original NVD description (English source)
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.