On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
Summary
| CVE | CVE-2024-27891 |
|---|---|
| State | PUBLISHED |
| Assigner | Arista |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-04 23:16:47 UTC |
| Updated | 2026-06-05 15:02:34 UTC |
| Description | On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied. |
Risk And Classification
Primary CVSS: v4.0 6.9 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.001210000 probability, percentile 0.306300000 (date 2026-06-10)
Problem Types: CWE-284 | CWE-284 CWE-284 Improper Access Control
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Arista Networks | EOS | affected 4.32.0 4.32.0.1F custom | 722XPM Series |
| CNA | Arista Networks | EOS | affected 4.31.0 4.31.2F custom | 722XPM Series |
| CNA | Arista Networks | EOS | affected 4.30.0 4.30.6M custom | 722XPM Series |
| CNA | Arista Networks | EOS | affected 4.29.0 4.29.7M custom | 722XPM Series |
| CNA | Arista Networks | EOS | affected 4.28.0 4.28.10.1M custom | 722XPM Series |
| CNA | Arista Networks | EOS | affected 4.27.2F 4.28.0 custom | 722XPM Series |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.arista.com/en/support/advisories-notices/security-advisory/19908-securit... | [email protected] | www.arista.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2024-27891 has been fixed in the following releases: * 4.32.1F and later releases in the 4.32.x train * 4.31.3M and later releases in the 4.31.x train * 4.30.7M and later releases in the 4.30.x train * 4.29.8M and later releases in the 4.29.x train * 4.28.11M and later releases in the 4.28.x train
Workarounds
CNA: The workaround is to disable MACsec on interfaces with outbound packet ACLs, or to use inbound packet ACLs where possible. Note that ingress ACLs might need to be applied to a different set of interfaces or to other devices in the network. switch#configure switch(config)#interface Ethernet1 switch(config-if-Et1)#no mac security profile ! or remove/replace the `out` ACL ! Note that you may wish to apply `in` ACLs to a different set of ! interfaces than `out` ACLs were applied to. switch#configure switch(config)#interface Ethernet1 switch(config-if-Et1)#mac access-group <ACL name> in switch(config-if-Et1)#ip access-group <ACL name> in switch(config-if-Et1)#ipv6 access-group <ACL name> in switch(config-if-Et1)#no mac access-group out switch(config-if-Et1)#no ip access-group out switch(config-if-Et1)#no ipv6 access-group out For more information about ACLs see EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .