The vulnerability in Arista EOS allows a gNMI Set request to be processed despite OpenConfig being configured to reject such requests when no SSL profiles are enabled. This flaw results in the switch applying unintended configuration changes, which can alter routing, security, or other network behavior. The weakness is a missing authentication or authorization check (CWE‑306), leading to potential integrity violations but not directly enabling code execution or data exfiltration.

Arista Networks EOS is affected. Versions lower than 4.30.0M, 4.29.8M, and 4.28.11M remain vulnerable. All firmware in the 4.28.x, 4.29.x, and 4.30.x trains before the listed release thresholds are susceptible. Upgrading to 4.30.0M or later, 4.29.8M or later, or 4.28.11M or later releases resolves the issue.

The CVSS score of 7.2 places this vulnerability in the medium to high severity range. No EPSS data is available, and it is not currently catalogued in CISA KEV. Attackers need network access to the gNMI interface and must exploit the lack of SSL profile enforcement; thus, the likely attack vector is a remotely reachable network device with OpenConfig enabled. The impact is the unauthorized application of configuration changes, potentially disrupting network operation.