CVE-2025-5089Arista EOS SysDB Agent Denial of Service via Malformed CVX Client/Server Messages
Updated under an hour ago ()
Does this affect you?
It affects Arista Networks EOS / CloudVision eXchange (CVX). Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. This leads to either a Sysdb agent crash on the EOS device causing a soft reset of the switch or agent crashes on the CVX server causing instability of the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to already have a high privilege access to the connected device to be able to send custom TCP packets. EOS switches that are not connected to a CVX server are not impacted.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-20
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Arista
- NVD analysis
- Awaiting Analysis
- Record last updated
- Jun 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Arista Networks EOS / CloudVision eXchange (CVX) arista_networks:eos_cloudvision_exchange_cvx (from the name) | from 4.34.0F through 4.34.1F; from 4.33.0M through 4.33.4M; from 4.32.0M through 4.32.6M; from 4.31.0M through 4.31.8M; from 4.30.0 before 4.31.0 | CNA record |
References
- https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.