{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-27891", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2024-02-26T18:06:32.161Z", "datePublished": "2026-06-04T22:08:42.522Z", "dateUpdated": "2026-06-05T18:28:50.823Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-06-04T22:08:42.522Z"}, "title": "On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.", "datePublic": "2024-07-23T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "platforms": ["722XPM Series"], "versions": [{"status": "affected", "version": "4.32.0", "lessThanOrEqual": "4.32.0.1F", "versionType": "custom"}, {"status": "affected", "version": "4.31.0", "lessThanOrEqual": "4.31.2F", "versionType": "custom"}, {"status": "affected", "version": "4.30.0", "lessThanOrEqual": "4.30.6M", "versionType": "custom"}, {"status": "affected", "version": "4.29.0", "lessThanOrEqual": "4.29.7M", "versionType": "custom"}, {"status": "affected", "version": "4.28.0", "lessThanOrEqual": "4.28.10.1M", "versionType": "custom"}, {"status": "affected", "version": "4.27.2F", "lessThan": "4.28.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.</span><br>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19908-security-advisory-0102"}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2024-27891, multiple specific conditions must be met. Both MACsec and egress ACLs must be configured and active on the same interface as the minimum requirements for this issue to be exposed. Please review the following sections to identify if your organization is affected.\n\n * MACsec must be configured:\n\n\nswitch>show mac security status\nAdministrative State: \u00a0 \u00a0 enabled\nActive Profiles:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 1\nData Delay Protection:\u00a0 \u00a0 no\nEAPoL Destination MAC:\u00a0 \u00a0 0180.c200.0003\nFIPS Mode:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 no\nSecured Interfaces: \u00a0 \u00a0 \u00a0 54\nLicense:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 enabled\n\n\n\n\nNote:\u00a0active profiles is not 0, and number of secured interfaces is not 0\n\nIf MACsec is not configured there is no exposure to this issue and the message will include 0 Active Profiles, and 0 Secured Interfaces.\n\n\n\nswitch>show mac security status\nAdministrative State: \u00a0 \u00a0 enabled\nActive Profiles:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\nData Delay Protection:\u00a0 \u00a0 no\nEAPoL Destination MAC:\u00a0 \u00a0 0180.c200.0003\nFIPS Mode:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 no\nSecured Interfaces: \u00a0 \u00a0 \u00a0 0\nLicense:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 disabled (Hardware license not enabled)\n\n\n\u00a0\n\n\n * Access Control Lists (ACLs) must be configured for outbound packets:\n\n\nswitch#show running-config | section access-list\nipv6 access-list testIp6Acl\nip access-list testIpAcl\nmac access-list testMacAcl\n \nswitch#show running-config | section access-group\ninterface Ethernet1\n\u00a0\u00a0\u00a0ip access-group testIpAcl out", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2024-27891, multiple specific conditions must be met. Both MACsec and egress ACLs must be configured and active on the same interface as the minimum requirements for this issue to be exposed. Please review the following sections to identify if your organization is affected.</p><ol><li>MACsec must be configured:<br><pre>switch&gt;show mac security status\nAdministrative State: &nbsp; &nbsp; enabled\nActive Profiles:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1\nData Delay Protection:&nbsp; &nbsp; no\nEAPoL Destination MAC:&nbsp; &nbsp; 0180.c200.0003\nFIPS Mode:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; no\nSecured Interfaces: &nbsp; &nbsp; &nbsp; 54\nLicense:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; enabled\n</pre><p><b>Note:</b>&nbsp;active profiles is not 0, and number of secured interfaces is not 0</p><div>If MACsec is not configured there is no exposure to this issue and the message will include 0 Active Profiles, and 0 Secured Interfaces.</div><pre>switch&gt;show mac security status\nAdministrative State: &nbsp; &nbsp; enabled\nActive Profiles:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0\nData Delay Protection:&nbsp; &nbsp; no\nEAPoL Destination MAC:&nbsp; &nbsp; 0180.c200.0003\nFIPS Mode:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; no\nSecured Interfaces: &nbsp; &nbsp; &nbsp; 0\nLicense:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; disabled (Hardware license not enabled)\n</pre><div>&nbsp;</div></li><li>Access Control Lists (ACLs) must be configured for outbound packets:<br><pre>switch#show running-config | section access-list\nipv6 access-list testIp6Acl\nip access-list testIpAcl\nmac access-list testMacAcl\n \nswitch#show running-config | section access-group\ninterface Ethernet1\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl out\n</pre></li></ol><div>&nbsp;</div><div><br></div>"}]}, {"lang": "en", "value": "The total number of ACLs configured must be any of the following:\n\n * More than 3 MAC ACLs, or\n * More than 7 IPv4 ACLs, or\n * More than 3 IPv6 ACLs\n\n\nIf for each ACL type in use, there are less than the above corresponding number configured there is no exposure to this issue.\n\nIf ACLs are not configured for outbound packets there is no exposure to this issue and the message will look like:\n\n\n\n! Notice no output below, indicating no ACLs configured\n! or notice ACLs are applied as \u201cin\u201d only.\nswitch#show running-config | section access-list\nswitch#\nswitch#show running-config | section access-group\ninterface Ethernet1\n\u00a0\u00a0\u00a0ip access-group testIpAcl in\n\n\n\u00a0\n\n\n\nIf no interfaces which have ACLs configured for outbound packets have MACsec configured, there is no exposure to this issue.\n\n\n\nNote that interface types such as Vlan interfaces, or Port-Channel interfaces may have none, one or multiple physical interfaces.\n\n\n\nTo check for MACsec configuration, first resolve the access-group configured interfaces to a list of all Ethernet physical interfaces.\n\n\n\nIn the example below, there is an ACL applied to Port-Channel1 (Ethernet1, Ethernet5), Vlan613 (Ethernet2, Ethernet4) and Ethernet3. Therefore Ethernet1-5 should be checked to see if MACsec is enabled.\n\n\n\nswitch#show running-config | section access-group\ninterface Port-Channel1\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl out\ninterface Ethernet3\n\u00a0\u00a0\u00a0ip access-group testIpAcl in\ninterface Vlan613\n\u00a0\u00a0\u00a0ip access-group testIpAcl out\n \nswitch>show port-channel 1 brief\nPort Channel Port-Channel1:\n\u00a0\u00a0Active Ports: Ethernet1 Ethernet5\n \nswitch>show vlan 613\nVLAN\u00a0 Name \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Status\u00a0 \u00a0 Ports\n----- -------------------------------- --------- -------------------------------\n613 \u00a0 VLAN0613 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 active\u00a0 \u00a0 Cpu, Et2, Et4\n \nswitch>show mac security interface Ethernet1-5\nInterface \u00a0 \u00a0 \u00a0 SCI \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Controlled Port\u00a0 \u00a0 \u00a0 Key in Use\nEthernet1 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet2 \u00a0 \u00a0 \u00a0 00:00:00:00:00:00::0\u00a0 \u00a0 \u00a0 False\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 None\nEthernet5 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\n\n\n\n\nIn the above example Ethernet1 and Ethernet5 have MACsec enabled.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The total number of ACLs configured must be any of the following:</div><ol><li>More than 3 MAC ACLs, or</li><li>More than 7 IPv4 ACLs, or</li><li>More than 3 IPv6 ACLs</li></ol><p>If for each ACL type in use, there are less than the above corresponding number configured there is no exposure to this issue.</p><div>If ACLs are not configured for outbound packets there is no exposure to this issue and the message will look like:</div><pre>! Notice no output below, indicating no ACLs configured\n! or notice ACLs are applied as \u201cin\u201d only.\nswitch#show running-config | section access-list\nswitch#\nswitch#show running-config | section access-group\ninterface Ethernet1\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl in\n</pre><div>&nbsp;</div><p>If no interfaces which have ACLs configured for outbound packets have MACsec configured, there is no exposure to this issue.</p><p>Note that interface types such as Vlan interfaces, or Port-Channel interfaces may have none, one or multiple physical interfaces.</p><p>To check for MACsec configuration, first resolve the access-group configured interfaces to a list of all Ethernet physical interfaces.</p><p>In the example below, there is an ACL applied to Port-Channel1 (Ethernet1, Ethernet5), Vlan613 (Ethernet2, Ethernet4) and Ethernet3. Therefore Ethernet1-5 should be checked to see if MACsec is enabled.</p><pre>switch#show running-config | section access-group\ninterface Port-Channel1\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl out\ninterface Ethernet3\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl in\ninterface Vlan613\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl out\n \nswitch&gt;show port-channel 1 brief\nPort Channel Port-Channel1:\n&nbsp;&nbsp;Active Ports: Ethernet1 Ethernet5\n \nswitch&gt;show vlan 613\nVLAN&nbsp; Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Status&nbsp; &nbsp; Ports\n----- -------------------------------- --------- -------------------------------\n613 &nbsp; VLAN0613 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; active&nbsp; &nbsp; Cpu, Et2, Et4\n \nswitch&gt;show mac security interface Ethernet1-5\nInterface &nbsp; &nbsp; &nbsp; SCI &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Controlled Port&nbsp; &nbsp; &nbsp; Key in Use\nEthernet1 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet2 &nbsp; &nbsp; &nbsp; 00:00:00:00:00:00::0&nbsp; &nbsp; &nbsp; False&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; None\nEthernet5 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\n</pre><p>In the above example Ethernet1 and Ethernet5 have MACsec enabled.</p><p><br></p>"}]}, {"lang": "en", "value": "In the example below, there are more than 3 IPv6 ACLs applied for outbound packets. All physical interfaces that are MACsec enabled, and have an IPv6 ACL applied for outbound packets, are exposed to this issue.\n\n\n\nswitch#show running-config | section access-group\ninterface Port-Channel1\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl out\ninterface Ethernet3\n\u00a0\u00a0\u00a0ip access-group testIpAcl in\ninterface Ethernet45\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl2 out\ninterface Ethernet46\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl3 out\ninterface Ethernet47\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl4 out\ninterface Vlan613\n\u00a0\u00a0\u00a0ip access-group testIpAcl out\n \nswitch>show port-channel 1 brief\nPort Channel Port-Channel1:\n\u00a0\u00a0Active Ports: Ethernet1 Ethernet5\n \nswitch>show vlan 613\nVLAN\u00a0 Name \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Status\u00a0 \u00a0 Ports\n----- -------------------------------- --------- -------------------------------\n613 \u00a0 VLAN0613 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 active\u00a0 \u00a0 Cpu, Et2, Et4\n \nswitch>show mac security interface Ethernet1-$ | grep True\nEthernet1 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet2 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet5 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet45 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\n\n\n\u00a0\n\nInterface\u201cOut\u201d ACLMinimum ACL count metMACsec enabledAffectedEt1YesYesYesYesEt2YesNo (only one IPv4 ACL)YesNoEt3NoNo (only one IPv4 ACL)NoNoEt4YesNo (only one IPv4 ACL)NoNoEt5YesYesYesYesEt45YesYesYesYesEt46YesYesNoNoEt47YesYesNoNo\n\n\u00a0\n\nIn the above example and table:\n\n * Ethernet46 and Ethernet47 are not exposed to this issue, because they are not MACsec enabled.\n * Ethernet2, Ethernet3, and Ethernet4 are not exposed to this issue because there is only one IPv4 ACL group, which is less than the required number to be exposed for that ACL type.\n * Ethernet3 is also not affected because the ACL is for incoming packets.\n * Ethernet1, Ethernet5, and Ethernet45 are affected by this issue because they meet the conditions required.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In the example below, there are more than 3 IPv6 ACLs applied for outbound packets. All physical interfaces that are MACsec enabled, and have an IPv6 ACL applied for outbound packets, are exposed to this issue.</p><pre>switch#show running-config | section access-group\ninterface Port-Channel1\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl out\ninterface Ethernet3\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl in\ninterface Ethernet45\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl2 out\ninterface Ethernet46\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl3 out\ninterface Ethernet47\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl4 out\ninterface Vlan613\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl out\n \nswitch&gt;show port-channel 1 brief\nPort Channel Port-Channel1:\n&nbsp;&nbsp;Active Ports: Ethernet1 Ethernet5\n \nswitch&gt;show vlan 613\nVLAN&nbsp; Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Status&nbsp; &nbsp; Ports\n----- -------------------------------- --------- -------------------------------\n613 &nbsp; VLAN0613 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; active&nbsp; &nbsp; Cpu, Et2, Et4\n \nswitch&gt;show mac security interface Ethernet1-$ | grep True\nEthernet1 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet2 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet5 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet45 &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\n</pre><div>&nbsp;</div><div><table><thead><tr><th><b>Interface</b></th><th><b>\u201cOut\u201d ACL</b></th><th><b>Minimum ACL count met</b></th><th><b>MACsec enabled</b></th><th><b>Affected</b></th></tr></thead><tbody><tr><td>Et1</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Et2</td><td>Yes</td><td>No (only one IPv4 ACL)</td><td>Yes</td><td>No</td></tr><tr><td>Et3</td><td>No</td><td>No (only one IPv4 ACL)</td><td>No</td><td>No</td></tr><tr><td>Et4</td><td>Yes</td><td>No (only one IPv4 ACL)</td><td>No</td><td>No</td></tr><tr><td>Et5</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Et45</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Et46</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Et47</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr></tbody></table></div><div>&nbsp;</div><div>In the above example and table:</div><ul><li>Ethernet46 and Ethernet47 are not exposed to this issue, because they are not MACsec enabled.</li><li>Ethernet2, Ethernet3, and Ethernet4 are not exposed to this issue because there is only one IPv4 ACL group, which is less than the required number to be exposed for that ACL type.</li><li>Ethernet3 is also not affected because the ACL is for incoming packets.</li><li>Ethernet1, Ethernet5, and Ethernet45 are affected by this issue because they meet the conditions required.</li></ul>"}]}], "workarounds": [{"lang": "en", "value": "The workaround is to disable MACsec on interfaces with outbound packet ACLs, or to use inbound packet ACLs where possible. Note that ingress ACLs might need to be applied to a different set of interfaces or to other devices in the network.\n\n\n\nswitch#configure\nswitch(config)#interface Ethernet1\nswitch(config-if-Et1)#no mac security profile\n \n! or remove/replace the `out` ACL\n! Note that you may wish to apply `in` ACLs to a different set of\n! interfaces than `out` ACLs were applied to.\n \nswitch#configure\nswitch(config)#interface Ethernet1\nswitch(config-if-Et1)#mac access-group <ACL name> in\nswitch(config-if-Et1)#ip access-group <ACL name> in\nswitch(config-if-Et1)#ipv6 access-group <ACL name> in\nswitch(config-if-Et1)#no mac access-group out\nswitch(config-if-Et1)#no ip access-group out\nswitch(config-if-Et1)#no ipv6 access-group out\n\n\n\n\nFor more information about ACLs see\u00a0 EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The workaround is to disable MACsec on interfaces with outbound packet ACLs, or to use inbound packet ACLs where possible. Note that ingress ACLs might need to be applied to a different set of interfaces or to other devices in the network.</p><pre>switch#configure<br>switch(config)#interface Ethernet1\nswitch(config-if-Et1)#no mac security profile\n \n! or remove/replace the `out` ACL\n! Note that you may wish to apply `in` ACLs to a different set of\n! interfaces than `out` ACLs were applied to.\n \nswitch#configure<br>switch(config)#interface Ethernet1\nswitch(config-if-Et1)#mac access-group &lt;ACL name&gt; in\nswitch(config-if-Et1)#ip access-group &lt;ACL name&gt; in\nswitch(config-if-Et1)#ipv6 access-group &lt;ACL name&gt; in\nswitch(config-if-Et1)#no mac access-group out\nswitch(config-if-Et1)#no ip access-group out\nswitch(config-if-Et1)#no ipv6 access-group out\n</pre><p>For more information about ACLs see&nbsp;<a href=\"https://www.arista.com/en/um-eos/eos-acls-and-route-maps\" target=\"_blank\" rel=\"noopener noreferrer\">EOS User Manual: ACLs and Route Maps</a>.</p>"}]}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\nFor more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2024-27891 has been fixed in the following releases:\n\n * 4.32.1F and later releases in the 4.32.x train \n * 4.31.3M and later releases in the 4.31.x train\n * 4.30.7M and later releases in the 4.30.x train\n * 4.29.8M and later releases in the 4.29.x train\n * 4.28.11M and later releases in the 4.28.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.<br>For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><div>CVE-2024-27891 has been fixed in the following releases:</div><ul><li>4.32.1F and later releases in the 4.32.x train</li><li>4.31.3M and later releases in the 4.31.x train</li><li>4.30.7M and later releases in the 4.30.x train</li><li>4.29.8M and later releases in the 4.29.x train</li><li>4.28.11M and later releases in the 4.28.x train</li></ul>"}]}], "source": {"defect": ["BUG 906098"], "advisory": "102", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}, "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-05T18:28:35.666431Z", "id": "CVE-2024-27891", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T18:28:50.823Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-27891", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2024-02-26T18:06:32.161Z", "datePublished": "2026-06-04T22:08:42.522Z", "dateUpdated": "2026-06-05T18:28:50.823Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-06-04T22:08:42.522Z"}, "title": "On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.", "datePublic": "2024-07-23T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "platforms": ["722XPM Series"], "versions": [{"status": "affected", "version": "4.32.0", "lessThanOrEqual": "4.32.0.1F", "versionType": "custom"}, {"status": "affected", "version": "4.31.0", "lessThanOrEqual": "4.31.2F", "versionType": "custom"}, {"status": "affected", "version": "4.30.0", "lessThanOrEqual": "4.30.6M", "versionType": "custom"}, {"status": "affected", "version": "4.29.0", "lessThanOrEqual": "4.29.7M", "versionType": "custom"}, {"status": "affected", "version": "4.28.0", "lessThanOrEqual": "4.28.10.1M", "versionType": "custom"}, {"status": "affected", "version": "4.27.2F", "lessThan": "4.28.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.</span><br>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19908-security-advisory-0102"}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2024-27891, multiple specific conditions must be met. Both MACsec and egress ACLs must be configured and active on the same interface as the minimum requirements for this issue to be exposed. Please review the following sections to identify if your organization is affected.\n\n * MACsec must be configured:\n\n\nswitch>show mac security status\nAdministrative State: \u00a0 \u00a0 enabled\nActive Profiles:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 1\nData Delay Protection:\u00a0 \u00a0 no\nEAPoL Destination MAC:\u00a0 \u00a0 0180.c200.0003\nFIPS Mode:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 no\nSecured Interfaces: \u00a0 \u00a0 \u00a0 54\nLicense:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 enabled\n\n\n\n\nNote:\u00a0active profiles is not 0, and number of secured interfaces is not 0\n\nIf MACsec is not configured there is no exposure to this issue and the message will include 0 Active Profiles, and 0 Secured Interfaces.\n\n\n\nswitch>show mac security status\nAdministrative State: \u00a0 \u00a0 enabled\nActive Profiles:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\nData Delay Protection:\u00a0 \u00a0 no\nEAPoL Destination MAC:\u00a0 \u00a0 0180.c200.0003\nFIPS Mode:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 no\nSecured Interfaces: \u00a0 \u00a0 \u00a0 0\nLicense:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 disabled (Hardware license not enabled)\n\n\n\u00a0\n\n\n * Access Control Lists (ACLs) must be configured for outbound packets:\n\n\nswitch#show running-config | section access-list\nipv6 access-list testIp6Acl\nip access-list testIpAcl\nmac access-list testMacAcl\n \nswitch#show running-config | section access-group\ninterface Ethernet1\n\u00a0\u00a0\u00a0ip access-group testIpAcl out", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2024-27891, multiple specific conditions must be met. Both MACsec and egress ACLs must be configured and active on the same interface as the minimum requirements for this issue to be exposed. Please review the following sections to identify if your organization is affected.</p><ol><li>MACsec must be configured:<br><pre>switch&gt;show mac security status\nAdministrative State: &nbsp; &nbsp; enabled\nActive Profiles:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1\nData Delay Protection:&nbsp; &nbsp; no\nEAPoL Destination MAC:&nbsp; &nbsp; 0180.c200.0003\nFIPS Mode:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; no\nSecured Interfaces: &nbsp; &nbsp; &nbsp; 54\nLicense:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; enabled\n</pre><p><b>Note:</b>&nbsp;active profiles is not 0, and number of secured interfaces is not 0</p><div>If MACsec is not configured there is no exposure to this issue and the message will include 0 Active Profiles, and 0 Secured Interfaces.</div><pre>switch&gt;show mac security status\nAdministrative State: &nbsp; &nbsp; enabled\nActive Profiles:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0\nData Delay Protection:&nbsp; &nbsp; no\nEAPoL Destination MAC:&nbsp; &nbsp; 0180.c200.0003\nFIPS Mode:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; no\nSecured Interfaces: &nbsp; &nbsp; &nbsp; 0\nLicense:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; disabled (Hardware license not enabled)\n</pre><div>&nbsp;</div></li><li>Access Control Lists (ACLs) must be configured for outbound packets:<br><pre>switch#show running-config | section access-list\nipv6 access-list testIp6Acl\nip access-list testIpAcl\nmac access-list testMacAcl\n \nswitch#show running-config | section access-group\ninterface Ethernet1\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl out\n</pre></li></ol><div>&nbsp;</div><div><br></div>"}]}, {"lang": "en", "value": "The total number of ACLs configured must be any of the following:\n\n * More than 3 MAC ACLs, or\n * More than 7 IPv4 ACLs, or\n * More than 3 IPv6 ACLs\n\n\nIf for each ACL type in use, there are less than the above corresponding number configured there is no exposure to this issue.\n\nIf ACLs are not configured for outbound packets there is no exposure to this issue and the message will look like:\n\n\n\n! Notice no output below, indicating no ACLs configured\n! or notice ACLs are applied as \u201cin\u201d only.\nswitch#show running-config | section access-list\nswitch#\nswitch#show running-config | section access-group\ninterface Ethernet1\n\u00a0\u00a0\u00a0ip access-group testIpAcl in\n\n\n\u00a0\n\n\n\nIf no interfaces which have ACLs configured for outbound packets have MACsec configured, there is no exposure to this issue.\n\n\n\nNote that interface types such as Vlan interfaces, or Port-Channel interfaces may have none, one or multiple physical interfaces.\n\n\n\nTo check for MACsec configuration, first resolve the access-group configured interfaces to a list of all Ethernet physical interfaces.\n\n\n\nIn the example below, there is an ACL applied to Port-Channel1 (Ethernet1, Ethernet5), Vlan613 (Ethernet2, Ethernet4) and Ethernet3. Therefore Ethernet1-5 should be checked to see if MACsec is enabled.\n\n\n\nswitch#show running-config | section access-group\ninterface Port-Channel1\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl out\ninterface Ethernet3\n\u00a0\u00a0\u00a0ip access-group testIpAcl in\ninterface Vlan613\n\u00a0\u00a0\u00a0ip access-group testIpAcl out\n \nswitch>show port-channel 1 brief\nPort Channel Port-Channel1:\n\u00a0\u00a0Active Ports: Ethernet1 Ethernet5\n \nswitch>show vlan 613\nVLAN\u00a0 Name \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Status\u00a0 \u00a0 Ports\n----- -------------------------------- --------- -------------------------------\n613 \u00a0 VLAN0613 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 active\u00a0 \u00a0 Cpu, Et2, Et4\n \nswitch>show mac security interface Ethernet1-5\nInterface \u00a0 \u00a0 \u00a0 SCI \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Controlled Port\u00a0 \u00a0 \u00a0 Key in Use\nEthernet1 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet2 \u00a0 \u00a0 \u00a0 00:00:00:00:00:00::0\u00a0 \u00a0 \u00a0 False\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 None\nEthernet5 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\n\n\n\n\nIn the above example Ethernet1 and Ethernet5 have MACsec enabled.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The total number of ACLs configured must be any of the following:</div><ol><li>More than 3 MAC ACLs, or</li><li>More than 7 IPv4 ACLs, or</li><li>More than 3 IPv6 ACLs</li></ol><p>If for each ACL type in use, there are less than the above corresponding number configured there is no exposure to this issue.</p><div>If ACLs are not configured for outbound packets there is no exposure to this issue and the message will look like:</div><pre>! Notice no output below, indicating no ACLs configured\n! or notice ACLs are applied as \u201cin\u201d only.\nswitch#show running-config | section access-list\nswitch#\nswitch#show running-config | section access-group\ninterface Ethernet1\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl in\n</pre><div>&nbsp;</div><p>If no interfaces which have ACLs configured for outbound packets have MACsec configured, there is no exposure to this issue.</p><p>Note that interface types such as Vlan interfaces, or Port-Channel interfaces may have none, one or multiple physical interfaces.</p><p>To check for MACsec configuration, first resolve the access-group configured interfaces to a list of all Ethernet physical interfaces.</p><p>In the example below, there is an ACL applied to Port-Channel1 (Ethernet1, Ethernet5), Vlan613 (Ethernet2, Ethernet4) and Ethernet3. Therefore Ethernet1-5 should be checked to see if MACsec is enabled.</p><pre>switch#show running-config | section access-group\ninterface Port-Channel1\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl out\ninterface Ethernet3\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl in\ninterface Vlan613\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl out\n \nswitch&gt;show port-channel 1 brief\nPort Channel Port-Channel1:\n&nbsp;&nbsp;Active Ports: Ethernet1 Ethernet5\n \nswitch&gt;show vlan 613\nVLAN&nbsp; Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Status&nbsp; &nbsp; Ports\n----- -------------------------------- --------- -------------------------------\n613 &nbsp; VLAN0613 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; active&nbsp; &nbsp; Cpu, Et2, Et4\n \nswitch&gt;show mac security interface Ethernet1-5\nInterface &nbsp; &nbsp; &nbsp; SCI &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Controlled Port&nbsp; &nbsp; &nbsp; Key in Use\nEthernet1 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet2 &nbsp; &nbsp; &nbsp; 00:00:00:00:00:00::0&nbsp; &nbsp; &nbsp; False&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; None\nEthernet5 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\n</pre><p>In the above example Ethernet1 and Ethernet5 have MACsec enabled.</p><p><br></p>"}]}, {"lang": "en", "value": "In the example below, there are more than 3 IPv6 ACLs applied for outbound packets. All physical interfaces that are MACsec enabled, and have an IPv6 ACL applied for outbound packets, are exposed to this issue.\n\n\n\nswitch#show running-config | section access-group\ninterface Port-Channel1\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl out\ninterface Ethernet3\n\u00a0\u00a0\u00a0ip access-group testIpAcl in\ninterface Ethernet45\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl2 out\ninterface Ethernet46\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl3 out\ninterface Ethernet47\n\u00a0\u00a0\u00a0ipv6 access-group testIp6Acl4 out\ninterface Vlan613\n\u00a0\u00a0\u00a0ip access-group testIpAcl out\n \nswitch>show port-channel 1 brief\nPort Channel Port-Channel1:\n\u00a0\u00a0Active Ports: Ethernet1 Ethernet5\n \nswitch>show vlan 613\nVLAN\u00a0 Name \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Status\u00a0 \u00a0 Ports\n----- -------------------------------- --------- -------------------------------\n613 \u00a0 VLAN0613 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 active\u00a0 \u00a0 Cpu, Et2, Et4\n \nswitch>show mac security interface Ethernet1-$ | grep True\nEthernet1 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet2 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet5 \u00a0 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\nEthernet45 \u00a0 \u00a0 12:15:35:24:c0:89::24193\u00a0 True\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 static SAK: Tx AN: 2\n\n\n\u00a0\n\nInterface\u201cOut\u201d ACLMinimum ACL count metMACsec enabledAffectedEt1YesYesYesYesEt2YesNo (only one IPv4 ACL)YesNoEt3NoNo (only one IPv4 ACL)NoNoEt4YesNo (only one IPv4 ACL)NoNoEt5YesYesYesYesEt45YesYesYesYesEt46YesYesNoNoEt47YesYesNoNo\n\n\u00a0\n\nIn the above example and table:\n\n * Ethernet46 and Ethernet47 are not exposed to this issue, because they are not MACsec enabled.\n * Ethernet2, Ethernet3, and Ethernet4 are not exposed to this issue because there is only one IPv4 ACL group, which is less than the required number to be exposed for that ACL type.\n * Ethernet3 is also not affected because the ACL is for incoming packets.\n * Ethernet1, Ethernet5, and Ethernet45 are affected by this issue because they meet the conditions required.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In the example below, there are more than 3 IPv6 ACLs applied for outbound packets. All physical interfaces that are MACsec enabled, and have an IPv6 ACL applied for outbound packets, are exposed to this issue.</p><pre>switch#show running-config | section access-group\ninterface Port-Channel1\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl out\ninterface Ethernet3\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl in\ninterface Ethernet45\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl2 out\ninterface Ethernet46\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl3 out\ninterface Ethernet47\n&nbsp;&nbsp;&nbsp;ipv6 access-group testIp6Acl4 out\ninterface Vlan613\n&nbsp;&nbsp;&nbsp;ip access-group testIpAcl out\n \nswitch&gt;show port-channel 1 brief\nPort Channel Port-Channel1:\n&nbsp;&nbsp;Active Ports: Ethernet1 Ethernet5\n \nswitch&gt;show vlan 613\nVLAN&nbsp; Name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Status&nbsp; &nbsp; Ports\n----- -------------------------------- --------- -------------------------------\n613 &nbsp; VLAN0613 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; active&nbsp; &nbsp; Cpu, Et2, Et4\n \nswitch&gt;show mac security interface Ethernet1-$ | grep True\nEthernet1 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet2 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet5 &nbsp; &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\nEthernet45 &nbsp; &nbsp; 12:15:35:24:c0:89::24193&nbsp; True&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; static SAK: Tx AN: 2\n</pre><div>&nbsp;</div><div><table><thead><tr><th><b>Interface</b></th><th><b>\u201cOut\u201d ACL</b></th><th><b>Minimum ACL count met</b></th><th><b>MACsec enabled</b></th><th><b>Affected</b></th></tr></thead><tbody><tr><td>Et1</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Et2</td><td>Yes</td><td>No (only one IPv4 ACL)</td><td>Yes</td><td>No</td></tr><tr><td>Et3</td><td>No</td><td>No (only one IPv4 ACL)</td><td>No</td><td>No</td></tr><tr><td>Et4</td><td>Yes</td><td>No (only one IPv4 ACL)</td><td>No</td><td>No</td></tr><tr><td>Et5</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Et45</td><td>Yes</td><td>Yes</td><td>Yes</td><td>Yes</td></tr><tr><td>Et46</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr><tr><td>Et47</td><td>Yes</td><td>Yes</td><td>No</td><td>No</td></tr></tbody></table></div><div>&nbsp;</div><div>In the above example and table:</div><ul><li>Ethernet46 and Ethernet47 are not exposed to this issue, because they are not MACsec enabled.</li><li>Ethernet2, Ethernet3, and Ethernet4 are not exposed to this issue because there is only one IPv4 ACL group, which is less than the required number to be exposed for that ACL type.</li><li>Ethernet3 is also not affected because the ACL is for incoming packets.</li><li>Ethernet1, Ethernet5, and Ethernet45 are affected by this issue because they meet the conditions required.</li></ul>"}]}], "workarounds": [{"lang": "en", "value": "The workaround is to disable MACsec on interfaces with outbound packet ACLs, or to use inbound packet ACLs where possible. Note that ingress ACLs might need to be applied to a different set of interfaces or to other devices in the network.\n\n\n\nswitch#configure\nswitch(config)#interface Ethernet1\nswitch(config-if-Et1)#no mac security profile\n \n! or remove/replace the `out` ACL\n! Note that you may wish to apply `in` ACLs to a different set of\n! interfaces than `out` ACLs were applied to.\n \nswitch#configure\nswitch(config)#interface Ethernet1\nswitch(config-if-Et1)#mac access-group <ACL name> in\nswitch(config-if-Et1)#ip access-group <ACL name> in\nswitch(config-if-Et1)#ipv6 access-group <ACL name> in\nswitch(config-if-Et1)#no mac access-group out\nswitch(config-if-Et1)#no ip access-group out\nswitch(config-if-Et1)#no ipv6 access-group out\n\n\n\n\nFor more information about ACLs see\u00a0 EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The workaround is to disable MACsec on interfaces with outbound packet ACLs, or to use inbound packet ACLs where possible. Note that ingress ACLs might need to be applied to a different set of interfaces or to other devices in the network.</p><pre>switch#configure<br>switch(config)#interface Ethernet1\nswitch(config-if-Et1)#no mac security profile\n \n! or remove/replace the `out` ACL\n! Note that you may wish to apply `in` ACLs to a different set of\n! interfaces than `out` ACLs were applied to.\n \nswitch#configure<br>switch(config)#interface Ethernet1\nswitch(config-if-Et1)#mac access-group &lt;ACL name&gt; in\nswitch(config-if-Et1)#ip access-group &lt;ACL name&gt; in\nswitch(config-if-Et1)#ipv6 access-group &lt;ACL name&gt; in\nswitch(config-if-Et1)#no mac access-group out\nswitch(config-if-Et1)#no ip access-group out\nswitch(config-if-Et1)#no ipv6 access-group out\n</pre><p>For more information about ACLs see&nbsp;<a href=\"https://www.arista.com/en/um-eos/eos-acls-and-route-maps\" target=\"_blank\" rel=\"noopener noreferrer\">EOS User Manual: ACLs and Route Maps</a>.</p>"}]}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\nFor more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2024-27891 has been fixed in the following releases:\n\n * 4.32.1F and later releases in the 4.32.x train \n * 4.31.3M and later releases in the 4.31.x train\n * 4.30.7M and later releases in the 4.30.x train\n * 4.29.8M and later releases in the 4.29.x train\n * 4.28.11M and later releases in the 4.28.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.<br>For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><div>CVE-2024-27891 has been fixed in the following releases:</div><ul><li>4.32.1F and later releases in the 4.32.x train</li><li>4.31.3M and later releases in the 4.31.x train</li><li>4.30.7M and later releases in the 4.30.x train</li><li>4.29.8M and later releases in the 4.29.x train</li><li>4.28.11M and later releases in the 4.28.x train</li></ul>"}]}], "source": {"defect": ["BUG 906098"], "advisory": "102", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}, "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27891", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-05T18:28:35.666431Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T18:28:43.519Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied."}], "id": "CVE-2024-27891", "lastModified": "2026-06-05T15:02:34.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-06-04T23:16:47.777", "references": [{"source": "[email protected]", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/19908-security-advisory-0102"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "[email protected]", "type": "Secondary"}]}

{}