CVE-2024-27890 — On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should hav…

CVE-2024-27890

On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled). PUBLISHED

Description (CNA)

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

Affected (CNA)

Vendor / product	Versions
Arista Networks / EOS	affected 4.29.0 through 4.29.7M; affected 4.28.0 through 4.28.10M; affected 4.27.0 through 4.27.8M; affected 4.26.0 through 4.26.9M; affected 4.25.0 through 4.25.10M; affected 4.24.0 through 4.24.11M

CWE

CWE-306

References

https://www.arista.com/en/support/advisories-notices/security-advisory/19862-security-advisory-0099

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.