CVE Catalog
CVE-2024-27892
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.30%
22th percentile - higher than 22% of all known CVEs
Summary
On platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
Risk Assessment
The risk includes unauthorized network configuration changes, which could lead to network disruptions, security policy violations, or incorrect routing.
Recommendation
Update Arista EOS to a version containing the fix and review the OpenConfig configuration to ensure proper validation of gNMI Set requests.
Original NVD description (English source)
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.