CVE-2024-27892: Arista EOS gNMI Authorization Bypass – CRITICAL Configuration Injection

Technical summary

CVE-2024-27892 involves a broken access control flaw (CWE-306) in Arista EOS when OpenConfig is configured. The gNMI (gRPC Network Management Interface) implementation fails to properly validate authorization on Set requests, permitting authenticated users to apply configuration changes they should not have permission to make. The vulnerability requires valid credentials but affects the confidentiality and availability of the network device through unauthorized state modifications.

Business impact

Network operators relying on Arista EOS in production environments face direct risk to infrastructure stability. An attacker with any valid account—including low-privilege service accounts—can reconfigure switches, potentially disrupting traffic forwarding, altering security policies, or creating pathways for lateral movement. The CRITICAL severity reflects the ability to impact entire network segments downstream of the affected switch.

Affected systems

Arista EOS platforms with OpenConfig functionality enabled are vulnerable. Consult Arista's official advisory to identify specific EOS versions and hardware platforms affected, as no version ranges are provided in public disclosures to date.

Exploitability

Exploitability is high due to low attack complexity and the requirement only for basic authentication (PR:L). The attack surface includes any interface exposing gNMI—typically management networks but potentially reachable from compromised internal systems. No known public exploits are tracked in CISA's Known Exploited Vulnerabilities catalog, though the flaw is straightforward enough that internal or targeted exploitation is plausible.

Remediation

Immediately identify Arista EOS instances with OpenConfig enabled. Apply vendor security patches as soon as they become available. Until patches are deployed, restrict gNMI access to trusted management networks and limit account privileges using role-based access control. Disable OpenConfig if it is not operationally required.

Patch guidance

Contact Arista Networks directly or monitor their security advisories for patch releases targeting CVE-2024-27892. Patches should be staged in a test environment first to validate compatibility with existing configurations. Plan maintenance windows to apply updates, as EOS switch reboots may be required depending on patch delivery method.

Detection guidance

Monitor gNMI Set request logs on affected Arista EOS switches for requests from unexpected users or service accounts. Look for configuration changes that don't correlate with change management tickets. Implement alerting on unauthorized privilege escalation attempts or access to restricted configuration parameters via gNMI. If available, enable audit logging for all gNMI operations.

Why prioritize this

This vulnerability merits highest priority because it permits direct manipulation of network infrastructure by authenticated attackers and carries CRITICAL severity. The combination of high impact (integrity and availability of network state) and low barriers to exploitation makes it an attractive target for both insider threats and attackers with compromised credentials.

Risk score, explained

CVSS 3.1 score of 9.6 reflects a network-adjacent attack requiring valid credentials (PR:L) but no user interaction, leading to high integrity and availability impact across connected systems (S:C). The score appropriately captures the ability to alter critical infrastructure configuration at scale.

Frequently asked questions