CVE-2024-27890

CriticalCVSS 9.6/10Last modified Jul 22, 2026

Description

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Arista NetworksEOS>= 4.29.0, <= 4.29.7M; >= 4.28.0, <= 4.28.10M; >= 4.27.0, <= 4.27.8M; >= 4.26.0, <= 4.26.9M; >= 4.25.0, <= 4.25.10M; >= 4.24.0, <= 4.24.11M

References

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2024

CVE-2024-278915.3On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforcedCVE-2024-278929.6Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can CVE-2024-278948.8The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation iCVE-2024-278957.5Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.CVE-2024-278967.5Input verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect integrity.CVE-2024-278977.5Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnerability may affect service confidentialitCVE-2024-278985.3SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web applicatCVE-2024-278998.8Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements fCVE-2024-27905.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all veCVE-2024-279005.3Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy settCVE-2024-279017.2SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users andCVE-2024-279026.1Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, re