Skip to content
OpenAdvisories
High WID-SEC-2025-2639 4 CVEs

Arista EOS: Mehrere Schwachstellen

Published Nov 18, 2025 · Updated Jun 7, 2026 · Revision 3 · de-DE

Vendor: Arista Networks Product: EOS Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Arista EOS ausnutzen, um einen Denial of Service Angriff durchzuführen, und um seine Privilegien zu erhöhen.

Product

Arista Extensible Operating System (EOS) ist ein modulares Linux basiertes Netzwerkbetriebssystem.

Vulnerabilities 4

  • High 8.3
    CVE-2025-5088

    Arista CloudVision Exchange (CVX) Cluster Privilege Escalation via MCS Redis Session

    An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all R…

    Arista Networks EOS / CloudVision eXchange (CVX) Network devices
  • High 7.5
    CVE-2025-8873

    Arista EOS Dataplane Denial of Service via Malformed IPsec Packet

    On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After res…

    Arista Networks EOS Network devices
  • Medium 6.5
    CVE-2025-5089

    Arista EOS SysDB Agent Denial of Service via Malformed CVX Client/Server Messages

    In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. T…

    Arista Networks EOS / CloudVision eXchange (CVX) Network devices
  • Medium 6.5
    CVE-2025-5090

    Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages

    CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the …

    Arista Networks EOS / CloudVision eXchange (CVX) Network devices

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2025-210075, EUVD-2025-210077, EUVD-2025-210076

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-210068

  3. #1

    Initiale Fassung

References