CVE-2024-27891 - Vulnerability Details

- On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.

Description

On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.

Published: 2026-06-04

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises when MACsec and egress ACLs are configured on the same interface in Arista EOS. In this configuration, the ACL policies may not be enforced for packets leaving the port, allowing traffic that should be filtered or denied. This represents an access control flaw (CWE‑284) that could enable an attacker to inject or exfiltrate traffic that is otherwise blocked.

Affected Systems

affected products are Arista Networks EOS firmware across several release trains. Versions prior to 4.32.1F in the 4.32.x train, 4.31.3M in the 4.31.x train, 4.30.7M in the 4.30.x train, 4.29.8M in the 4.29.x train, and 4.28.11M in the 4.28.x train are vulnerable. All releases before these specific build numbers lack the remedy.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk, and while EPSS is not available, the vulnerability is not currently listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector is an attacker with ability to send packets from the affected interface, which could be local or remote depending on network configuration. The flaw directly impacts compliance and security policy enforcement.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Arista Networks

EOS

unaffected

Version	Status	Constraints
`4.32.0`	affected	≤ 4.32.0.1F
`4.31.0`	affected	≤ 4.31.2F
`4.30.0`	affected	≤ 4.30.6M
`4.29.0`	affected	≤ 4.29.7M
`4.28.0`	affected	≤ 4.28.10.1M
`4.27.2F`	affected	< 4.28.0

No data.

Vendor Product Confidence Versions

Arista

Eos

100%

Version	Status	Scheme	Platform
`[4.32.0,4.32.0.1F]`	affected	generic	['722xpm_series']
`[4.31.0,4.31.2F]`	affected	generic	['722xpm_series']
`[4.30.0,4.30.6M]`	affected	generic	['722xpm_series']
`[4.29.0,4.29.7M]`	affected	generic	['722xpm_series']
`[4.28.0,4.28.10.1M]`	affected	generic	['722xpm_series']
`[4.27.2F,4.28.0)`	affected	generic	['722xpm_series']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-27891 has been fixed in the following releases: * 4.32.1F and later releases in the 4.32.x train * 4.31.3M and later releases in the 4.31.x train * 4.30.7M and later releases in the 4.30.x train * 4.29.8M and later releases in the 4.29.x train * 4.28.11M and later releases in the 4.28.x train

Vendor Workaround

The workaround is to disable MACsec on interfaces with outbound packet ACLs, or to use inbound packet ACLs where possible. Note that ingress ACLs might need to be applied to a different set of interfaces or to other devices in the network. switch#configure switch(config)#interface Ethernet1 switch(config-if-Et1)#no mac security profile ! or remove/replace the `out` ACL ! Note that you may wish to apply `in` ACLs to a different set of ! interfaces than `out` ACLs were applied to. switch#configure switch(config)#interface Ethernet1 switch(config-if-Et1)#mac access-group <ACL name> in switch(config-if-Et1)#ip access-group <ACL name> in switch(config-if-Et1)#ipv6 access-group <ACL name> in switch(config-if-Et1)#no mac access-group out switch(config-if-Et1)#no ip access-group out switch(config-if-Et1)#no ipv6 access-group out For more information about ACLs see EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .

OpenCVE Recommended Actions

Upgrade Arista EOS to the latest remediated version for the respective train (4.32.1F or later, 4.31.3M or later, etc.).
If upgrading immediately is not possible, disable MACsec on interfaces that have outbound ACLs.
Alternatively, move outbound ACLs to inbound ACLs on the same or other interfaces to maintain filtering.

Generated by OpenCVE AI on June 4, 2026 at 23:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00125.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.arista.com/en/support/advisories-notices/security-advisory/19908-security-advisory-0102

History

Fri, 05 Jun 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 05 Jun 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Arista Arista eos
Vendors & Products		Arista Arista eos

Thu, 04 Jun 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.
Title		On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
Weaknesses		CWE-284
References		https://www.arista.com/en/support/advisories-notices/security-advisory/19908-security-advisory-0102
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Arista Eos

MITRE

Status: PUBLISHED

Assigner: Arista

Published: 2026-06-04T22:08:42.522Z

Updated: 2026-06-05T18:28:50.823Z

Reserved: 2024-02-26T18:06:32.161Z

Link: CVE-2024-27891

Vulnrichment

Updated: 2026-06-05T18:28:43.519Z

NVD

Status : Awaiting Analysis

Published: 2026-06-04T23:16:47.777

Modified: 2026-06-05T15:02:34.977

Link: CVE-2024-27891

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-05T10:07:19Z

Weaknesses

CWE-284

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object