Arista EOS CVE-2024-27892: Brief Summary of a Critical gNMI Authentication Bypass in OpenConfig

Introduction

A missing authentication check in Arista EOS lets an attacker with low-privilege network access push arbitrary configuration changes to datacenter switches through the gNMI Set RPC. In effect, the attacker bypasses authorization controls on one of the most powerful operations in the management plane. Arista holds roughly 19% of the datacenter Ethernet switch market and forms the backbone of numerous hyperscale and enterprise fabrics, so this vulnerability (scored CVSS 9.6, Critical) could affect a significant portion of modern datacenter infrastructure.

CVE-2024-27892 applies only where OpenConfig is enabled with an SSL profile. That narrows the attack surface, but it also points straight at the highest-value targets: large-scale enterprises and cloud providers running automated, model-driven network management.

Technical Information

Root Cause: Missing Authentication for Critical Function (CWE-306)

CVE-2024-27892 falls under CWE-306, which covers software that performs no authentication for a function that either requires a provable user identity or consumes significant system resources. Here, that function is the gNMI (gRPC Network Management Interface) Set RPC.

The OpenConfig project defines gNMI as a gRPC-based protocol for retrieving and modifying configuration on network devices. The Set RPC modifies configurable attributes in the supported data models, which makes it, by design, one of the most powerful operations on the management interface. On an Arista EOS switch with OpenConfig and an SSL profile configured, a gNMI Set request should pass authentication and authorization checks. This vulnerability bypasses those checks, so the switch executes Set requests it should reject.

The vulnerability persisted across eight major EOS release trains (4.24 through 4.31). That suggests the per-RPC authorization check for the gNMI Set operation was missing from the architecture, rather than lost to a regression in one release. It also fits CWE-306, which describes missing authentication rather than broken authentication.

CVSS Vector Breakdown

The CVSSv3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H breaks down as follows:

The two CVSS versions disagree on the score. Under CVSSv4.0, the CNA-assessed score drops to 7.2 (High), with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. The 2.4-point gap comes from differences in how the two scoring systems handle scope changes and cross-boundary impact. Whichever CVSS version an organization uses to prioritize risk, it should treat this as at minimum a High-severity issue.

Attack Flow

Exploitation has two preconditions:

1. OpenConfig is enabled on the target Arista EOS switch.
2. An SSL profile is configured for the gNMI transport.

With both in place, the attack proceeds like this:

1. The attacker gains low-privilege network access to the gNMI endpoint on the target switch. This typically means access to the management network or any network segment where the gNMI service is reachable.

2. The attacker builds a gNMI Set request for any configurable attribute in the OpenConfig data model. Because the authorization check is missing, the switch does not validate the request against the user's privilege level.

3. The switch accepts the Set request and applies it to its configuration. The attacker can now modify access control lists to permit unauthorized traffic, alter routing protocol configurations to redirect traffic, change interface configurations to create network loops or partitions, or disable security features.

4. In a datacenter spine-leaf architecture, an attacker who changes a spine switch's configuration this way could intercept traffic, move laterally, or cause denial of service across the entire fabric.

The Changed scope (S:C) in the CVSS vector reflects this cascading impact. The flaw sits in the gNMI authorization logic, but the impact reaches the entire network domain the compromised switch serves.

Related Vulnerability: CVE-2024-27890

The same Arista advisory (Security Advisory 0099) documents a sibling vulnerability, CVE-2024-27890, with the same CWE classification and the same CVSS score of 9.6. CVE-2024-27890 needs only OpenConfig enabled, with no SSL profile, and that lower bar makes it easier to exploit. The same fixed releases resolve both. Arista tracks CVE-2024-27892 internally as BUG 912475 and CVE-2024-27890 as BUG 747512.

Patch Information

Arista Networks fixed CVE-2024-27892 in updated EOS releases, documented in Security Advisory 0099 (first published July 2, 2024, last revised July 25, 2024). The fix closes the gap in the OpenConfig/Octa agent's authentication enforcement: gNMI Set requests are now validated and rejected when the requesting user lacks authorization. The patch is tracked internally as BUG 912475.

Fixed EOS Versions

To fully resolve both CVE-2024-27892 and CVE-2024-27890, Arista recommends upgrading to at least 4.30.6M or 4.31.3M.

Hotfix Extensions

For operators who cannot do a full EOS upgrade right away, Arista provides SWIX hotfix extension packages that can be side-loaded onto specific earlier EOS versions. The hotfixes address both CVE-2024-27892 and CVE-2024-27890 and come in 32-bit and 64-bit variants for:

• EOS 4.30.5
• EOS 4.29.7
• EOS 4.28.10.1

Each hotfix ships as a .swix file (e.g., sa99-CVE-2024-27890_CVE-2024-27892_4.30.5_64_Hotfix.swix) with a SHA-512 hash for integrity verification.

Operational note: Installing or uninstalling the hotfix restarts the OpenConfig/Octa process, and gNMI services may be unavailable for up to one minute. After applying the hotfix, administrators should run copy installed-extensions boot-extensions so it persists across reboots. The EOS User Manual has full installation instructions under "Managing EOS Extensions."

Workarounds

Organizations that cannot patch immediately have three workarounds:

1. Per-RPC authorization. Apply per-RPC authorization rules so that no user is authorized to run the OpenConfig.Set command. This is the most targeted mitigation. It blocks only the vulnerable Set RPC and keeps gNMI Subscribe and Get operations available for telemetry collection.

2. Disable TLS. Remove the SSL profile from the gNMI transport configuration. CVE-2024-27892 requires an SSL profile, so removing TLS eliminates the precondition. It also removes encryption from the management channel, and it is generally not recommended.

3. Disable the OpenConfig agent. This eliminates the attack surface completely, and with it all OpenConfig/gNMI functionality.

Mitigation Strategy Comparison

As an immediate workaround, per-RPC authorization gives the best balance of security and operational continuity. A software upgrade is the definitive long-term fix.

Affected Systems and Versions

Affected Platforms

The vulnerability affects virtually the entire Arista EOS switching portfolio:

710, 720D, 720XP/722XPM, 750X, 7010, 7010X, 7020R, 7130 (running EOS), 7150, 7160, 7170, 7050X/X2/X3/X4, 7060X/X2/X4/X5/X6, 7250X, 7260X/X3, 7280E/R/R2/R3, 7300X/X3, 7320X, 7358X4, 7368X4, 7388X5, 7500E/R/R2/R3, 7800R3 Series, CloudEOS, cEOS-lab, and vEOS-lab.

Affected EOS Versions (CVE-2024-27892)

Vulnerable Configuration

The vulnerability requires both of these conditions:

1. OpenConfig is enabled on the switch.
2. An SSL profile is configured for the gNMI transport.

If OpenConfig is not configured, or if it is configured without an SSL profile, CVE-2024-27892 is not exploitable (though CVE-2024-27890 may still apply in the latter case).

Not Affected

These Arista products are not affected:

• Arista Wireless Access Points
• CloudVision WiFi (virtual, physical, or cloud service)
• CloudVision eXchange
• CloudVision Portal
• CloudVision as a Service
• CloudVision AGNI
• Arista 7130 Systems running MOS
• Arista Converged Cloud Fabric and DANZ Monitoring Fabric
• Arista Network Detection and Response (NDR) Security Platform
• Arista Edge Threat Management
• Arista NetVisor OS/UNUM/Insight Analytics

Vendor Security History

Arista Networks maintains a formal Product Security Incident Response Team (PSIRT), reachable at [email protected]. OpenCVE tracks 111 CVE records published by the company, 64 of them since 2021. No Arista CVEs appear in CISA's Known Exploited Vulnerabilities catalog, and only 8 have a known public exploit.

Recent advisories show active vulnerability management:

• Security Advisory 0094 (April 2024): Addressed HTTP/2 CONTINUATION flood vulnerabilities (CVE-2023-45288).
• Security Advisory 0097 (May 2024): Addressed externally reported vulnerabilities, with Arista noting no known malicious exploitation.
• Security Advisory 0099 (July 2024): Covers CVE-2024-27892 and CVE-2024-27890. First released July 2, 2024, then revised twice to update exploitation prerequisites and hotfix availability.

Arista's advisories consistently state that the company is "not aware of any malicious exploitation in customer networks." CVE-2024-27892 was discovered internally rather than by external researchers, which indicates that Arista's internal security testing is identifying vulnerabilities proactively.

The case also shows a tension in modern network automation. The model-driven management interfaces (OpenConfig/gNMI) that make network operations scalable and programmatic also expand the attack surface for configuration manipulation. Organizations deploying network automation at scale should enforce authorization at the per-RPC level, not just at the transport authentication level.

References

• Arista Security Advisory 0099
• NVD: CVE-2024-27892
• CWE-306: Missing Authentication for Critical Function
• gRPC Network Management Interface (gNMI) Specification
• OpenConfig gNMI GitHub Repository
• CISA Known Exploited Vulnerabilities Catalog
• Arista CVEs and Security Vulnerabilities on OpenCVE
• Arista Networks Vulnerabilities: CVEs, CISA KEV and Security Analysis
• IDC: Ethernet Switch Market Growth Driven by AI Demand
• Arista Security Advisory 0094
• Arista Security Advisory 0097
• Arista Advisories and Notices