Brief Summary: CVE-2024-27890 Authentication Bypass in Arista EOS OpenConfig gNMI Interface

Introduction

An authentication bypass in Arista EOS's OpenConfig implementation allows gNMI Set requests to modify switch configuration when they should be rejected. An attacker with network access to the management interface can use it to push unauthorized changes to data center switching infrastructure. Arista holds a 21.3% share of the data center Ethernet switch market and has over $9 billion in annual revenue, so this vulnerability could affect a meaningful slice of global data center networks running programmable, OpenConfig-enabled configurations.

Technical information

Root cause: CWE-306 Missing Authentication for Critical Function

CVE-2024-27890 is classified under CWE-306, a weakness where software does not validate user identity before allowing access to privileged application functionality. Here, the gNMI Set request handler on Arista EOS platforms with OpenConfig configured fails to enforce proper authentication before it executes configuration changes on the switch.

The gRPC Network Management Interface (gNMI) is a protocol defined by OpenConfig for modifying and retrieving configuration on network target devices. The OpenConfig gNMI specification describes it as "a gRPC based protocol for the modification and retrieval of configuration from a target device, as well as the control and generation of" telemetry data. The gNMI Set RPC is the operation that modifies device configuration. It specifies how to set one or more configurable attributes associated with a supported model, with a SetRequest sent from a client to a target device.

On affected EOS platforms, the authorization check that should gate the Set operation is missing or incorrectly implemented. A gNMI Set request can execute when the system should have rejected it, and the switch ends up with "unexpected configuration" applied.

CVSS v4.0 vector analysis

The CNA (Arista Networks) assessed this vulnerability with a CVSS v4.0 Base score of 7.2 HIGH using the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. The input-sourced CVSS v3.x score is 9.6. The key vector components break down as follows:

Vector component	Value	Interpretation
AV (Attack Vector)	N (Network)	Exploitable remotely over the network
AC (Attack Complexity)	L (Low)	No special conditions required
AT (Attack Requirements)	N (None)	No special preconditions
PR (Privileges Required)	L (Low)	Low-privilege access sufficient
UI (User Interaction)	N (None)	No user interaction needed
VI (Integrity Impact)	H (High)	High integrity impact to the vulnerable system
VA (Availability Impact)	H (High)	High availability impact to the vulnerable system

A network-based attack vector, low complexity, and low privilege requirements together make this vulnerability particularly accessible to attackers. There is no confidentiality impact (VC:N), which fits the nature of the flaw. It enables unauthorized configuration writes rather than data exfiltration.

Attack flow

Based on the vulnerability mechanism, exploitation would proceed as follows:

The attacker identifies an Arista EOS switch with OpenConfig configured and the gNMI service reachable over the network.
The attacker connects to the gNMI service endpoint on the target switch.
With only low-level privileges (or potentially bypassing authentication entirely, given the CWE-306 classification), the attacker crafts and sends a gNMI SetRequest message containing configuration modifications.
The switch processes the SetRequest without proper authorization validation and applies the configuration changes. These changes could include modifications to routing tables, access control lists, administrative credentials, or other critical switch parameters.

Scope limitation: OpenConfig requirement

The vulnerability only affects platforms where OpenConfig is configured. Organizations not using OpenConfig on their Arista switches are not vulnerable. However, OpenConfig is widely adopted in large-scale data center and cloud environments for programmable network management, which means the most automation-driven and typically largest deployments are the ones at risk.

Arista Security Advisory 0099 covers a second vulnerability, CVE-2024-27892, which shares the same root cause and description. Both CVEs involve the same gNMI Set request authentication gap on OpenConfig-configured platforms. The dual CVE assignment may reflect distinct code paths or affected component boundaries within the EOS OpenConfig implementation. CVE-2024-27892 additionally requires an SSL profile, which distinguishes it from CVE-2024-27890.

Patch information

Arista Networks addressed CVE-2024-27890 with permanent fixes in new EOS releases and with interim hotfix packages. The advisory (Security Advisory 0099, published July 2, 2024, last revised July 25, 2024) documents the resolution. The fix enforces proper authorization checks on incoming gNMI Set requests, so only authenticated and authorized sessions can modify device configuration through the OpenConfig interface. Arista tracked the internal bug as BUG 747512.

Fixed EOS versions

Release train	First fixed version
4.30.x	4.30.0M and later
4.29.x	4.29.8M and later
4.28.x	4.28.11M and later

Arista recommends upgrading to EOS 4.30.6, 4.31.3, or later to fully remediate both CVE-2024-27890 and the related CVE-2024-27892.

Hotfix packages

For environments where a full version upgrade is not immediately feasible, Arista provides downloadable SWIX hotfix extensions. These are targeted binary patches that fix both CVE-2024-27890 and CVE-2024-27892 in place. Hotfixes are available for the following EOS versions in both 32-bit and 64-bit variants:

EOS 4.30.5: e.g., sa99-CVE-2024-27890_CVE-2024-27892_4.30.5_64_Hotfix.swix
EOS 4.29.7: e.g., sa99-CVE-2024-27890_CVE-2024-27892_4.29.7_64_Hotfix.swix
EOS 4.28.10.1: e.g., sa99-CVE-2024-27890_CVE-2024-27892_4.28.10.1_64_Hotfix.swix

Each hotfix download comes with a SHA-512 hash for integrity verification.

Operational notes

Installing or uninstalling the SWIX hotfix restarts the OpenConfig/Octa process, which may leave gNMI services unavailable for up to one minute. After applying the extension, administrators must run copy installed-extensions boot-extensions so the patch persists across reboots.

Interim configuration controls

These measures do not replace patching, but they can reduce exposure:

Disable OpenConfig on devices where it is not operationally required, which removes the attack surface entirely.
Restrict gNMI network access using access control lists or management plane protection features.
Segment management networks so the gNMI interface is only reachable from authorized management segments.

Affected systems and versions

The vulnerability affects Arista EOS platforms with OpenConfig configured, specifically:

EOS 4.30.x releases prior to 4.30.0M
EOS 4.29.x releases prior to 4.29.8M
EOS 4.28.x releases prior to 4.28.11M

The vulnerability is only exploitable when OpenConfig is enabled on the device. Platforms without OpenConfig configured are not affected.

Vendor security history

Arista Networks runs an active security advisory program, with advisories numbering at least up to Advisory 0136, which indicates a steady cadence of vulnerability disclosure and remediation. Earlier advisories include responses to widely known vulnerabilities such as CVE-2024-6387 (OpenSSH "regreSSHion"), addressed in Advisory 0100. For previous vulnerabilities, Arista has stated it was "not aware of any malicious uses of this issue in customer networks," which suggests a generally proactive security posture.

OpenCVE tracks multiple Arista EOS CVEs, including recent entries such as CVE-2025-8870, in which serial console input causes an unexpected device reload. This pattern of ongoing vulnerability discoveries is consistent with the complexity of a Linux-based modular network operating system. Arista also runs an automated "CVE Scanner" process that searches for publicly disclosed vulnerabilities in open source packages used in EOS and supports its patch development and advisory publication workflow.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information