CVE-2024-27890

CriticalCVSS 9.6/10Last modified Jul 22, 2026

Description

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2024

CVE-2024-278915.3On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced CVE-2024-278929.6Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can CVE-2024-278948.8The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation i CVE-2024-278957.5Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.CVE-2024-278967.5Input verification vulnerability in the log module. Impact: Successful exploitation of this vulnerability can affect integrity.CVE-2024-278977.5Input verification vulnerability in the call module. Impact: Successful exploitation of this vulnerability may affect service confidentialit CVE-2024-278985.3SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web applicat CVE-2024-278998.8Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements f CVE-2024-27905.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all ve CVE-2024-279005.3Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy sett CVE-2024-279017.2SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and CVE-2024-279026.1Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, re