CVE-2024-27889

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Arista Networks	Arista Edge Threat Management - Arista NG Firewall (NGFW)	<= 17.0

References

https://https://www.arista.com/en/support/advisories-notices/security-advisory/19038-security-advisory-0093Broken Link, Vendor Advisory
https://https://www.arista.com/en/support/advisories-notices/security-advisory/19038-security-advisory-0093Broken Link, Vendor Advisory

Timeline

Published: Mar 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-27895.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Calendy widget in all vers CVE-2024-278909.6Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can CVE-2024-278915.3On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced CVE-2024-278929.6Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can CVE-2024-278948.8The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation i CVE-2024-278957.5Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.CVE-2024-278967.5Input verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect integrity.CVE-2024-278977.5Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnerability may affect service confidentialit CVE-2024-278985.3SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web applicat CVE-2024-278998.8Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements f CVE-2024-27905.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all ve CVE-2024-279005.3Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy sett