Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2025-5090

Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Arista

Description

CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Arista Networks EOS / CloudVision eXchange (CVX)

Default version status: unaffected

  • 4.34.0F to ≤ 4.34.1Faffected
  • 4.33.0M to ≤ 4.33.4Maffected
  • 4.32.0M to ≤ 4.32.6Maffected
  • 4.31.0 to < 4.32.0affected
  • 4.30.0 to < 4.31.0affected

References