CVE-2024-27892CWE-306

On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).

High · published June 4, 2026

CVSS v4.0
7.2
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00302 · 21.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-04T22:33Z
EPSS history
Timeline
  • 04 JUN 22:33Z
    On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).
    cvelistv5