CVE-2025-0936

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0936", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2025-01-31T17:18:43.715Z", "datePublished": "2025-05-07T22:52:25.444Z", "dateUpdated": "2025-05-08T13:02:27.046Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.33.1", "status": "affected", "version": "4.33.0", "versionType": "custom"}, {"lessThanOrEqual": "4.32.3M", "status": "affected", "version": "4.32.0", "versionType": "custom"}, {"lessThanOrEqual": "4.31.5M", "status": "affected", "version": "4.31.0", "versionType": "custom"}, {"lessThanOrEqual": "4.30.9M", "status": "affected", "version": "4.30.1F", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In order to be vulnerable to CVE-2025-0936, one or both of the following conditions must be met:</p><ul><li>OpenConfig must be enabled with a gNOI server with accounting enabled </li><li>OpenConfig must be enabled with a gNOI server with tracing enabled which includes any of:<br><ul><li>service/9</li><li>interceptor/9 </li><li>transport_socketcli/9 </li></ul></li></ul><p>If OpenConfig is enabled with a gNOI server with accounting enabled, this will be shown in the following CLI output:</p><pre>switch(config)#show management api gnmi\nTransport: default\nEnabled: <span style=\"background-color: rgb(255, 255, 0);\">yes</span>\nServer: running on port 6030, in default VRF\nSSL profile: none\nQoS DSCP: none\nAuthorization required: no\nAccounting requests: <span style=\"background-color: rgb(255, 255, 0);\">yes</span>\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n</pre><div>&nbsp;</div><p>If OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.</p><pre>switch(config)#show management api gnmi\nEnabled: <span style=\"background-color: rgb(255, 255, 0);\">no transports enabled</span>\n</pre><div>&nbsp;</div><p>To see the tracing enabled for OpenConfig, run:</p><pre>switch(config)#show running-config section trace | grep OpenConfig\ntrace OpenConfig setting <span style=\"background-color: rgb(255, 255, 0);\">service/9,interceptor/9,transport_socketcli/9</span>\n</pre><div>&nbsp;</div><p>Note: gRPC-based streaming via TerminAttr to CloudVision is not affected by this vulnerability.</p><br>"}], "value": "In order to be vulnerable to CVE-2025-0936, one or both of the following conditions must be met:\n\n * OpenConfig must be enabled with a gNOI server with accounting enabled \n * OpenConfig must be enabled with a gNOI server with tracing enabled which includes any of:\n * service/9\n * interceptor/9 \n * transport_socketcli/9 \n\n\n\n\n\nIf OpenConfig is enabled with a gNOI server with accounting enabled, this will be shown in the following CLI output:\n\nswitch(config)#show management api gnmi\nTransport: default\nEnabled: yes\nServer: running on port 6030, in default VRF\nSSL profile: none\nQoS DSCP: none\nAuthorization required: no\nAccounting requests: yes\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n\n\n\u00a0\n\nIf OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.\n\nswitch(config)#show management api gnmi\nEnabled: no transports enabled\n\n\n\u00a0\n\nTo see the tracing enabled for OpenConfig, run:\n\nswitch(config)#show running-config section trace | grep OpenConfig\ntrace OpenConfig setting service/9,interceptor/9,transport_socketcli/9\n\n\n\u00a0\n\nNote: gRPC-based streaming via TerminAttr to CloudVision is not affected by this vulnerability."}], "datePublic": "2025-05-06T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc).</span><br>"}], "value": "On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc)."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-05-07T22:52:25.444Z"}, "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><div>CVE-2025-0936 has been fixed in the following releases:</div><ul><li>4.30.10M and later releases in the 4.30.x train</li><li>4.31.7M and later releases in the 4.31.x train</li><li>4.32.5M and later releases in the 4.32.x train</li><li>4.33.2F and later releases</li></ul><br>"}], "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2025-0936 has been fixed in the following releases:\n\n * 4.30.10M and later releases in the 4.30.x train\n * 4.31.7M and later releases in the 4.31.x train\n * 4.32.5M and later releases in the 4.32.x train\n * 4.33.2F and later releases"}], "source": {"defect": ["BUG 1045796"], "discovery": "INTERNAL"}, "title": "On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>There are a number of possible workarounds:</p><h4>Option 1 - disable accounting/logging for the OpenConfig transport</h4><p>For example to disable accounting for transport named \u201cdefault\u201d:</p><pre>switch(config)#management api gnmi\nswitch(config-mgmt-api-gnmi)#transport grpc default\nswitch(config-gnmi-transport-default)#<span style=\"background-color: rgb(255, 255, 0);\">no accounting requests</span>\n</pre><div>&nbsp;</div><p>to disable logging for the OpenConfig agent, run:</p><pre>switch(config)#no trace OpenConfig setting\n</pre><div>&nbsp;</div><h4>Option 2 - disable the gNOI File service entirely</h4><p>To disable the gNOI File service, override the OCGNOIFileToggle, then restart OpenConfig to load the changes</p><pre>switch#bash timeout 100 echo \"OCGNOIFileToggle=0\" &gt;&gt; /mnt/flash/toggle_override\nswitch#agent OpenConfig terminate \n</pre><div>&nbsp;</div><p>Disabling the gNOI File service will mean that gNOI clients will no longer be able to call any gNOI File RPCs</p><h4>Option 3 - block the TransferToRemote RPC using gNSI Authz</h4><p>For releases with gNSI Authz (EOS 4.31.0F and later releases), the TransferToRemote RPC can be blocked using gNSI Authz.</p><p>First enable gNSI Authz service by adding the following config:</p><pre>switch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n</pre><p>Where [NAME] is the name of the running gNMI transport</p><p>Adding this config will cause the named gNMI transport to reload.</p><p>Next update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes:</p><pre>switch#bash timeout 100 echo \"{\\\"name\\\":\\\"block gNOI TransferToRemote policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"allow_all\\\"}],\\\"deny_rules\\\":[{\\\"name\\\":\\\"no-one-can-use-gnoi-transfer-to-remote\\\",\\\"request\\\":{\\\"paths\\\":[\\\"/gnoi.file.File/TransferToRemote\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json &amp;&amp; sleep 11\n</pre><div>&nbsp;</div><p>This will cause attempts to run the TransferToRemote RPC to fail with a \u201cPermissionDenied\u201d error code.</p><br>"}], "value": "There are a number of possible workarounds:\n\nOption 1 - disable accounting/logging for the OpenConfig transportFor example to disable accounting for transport named \u201cdefault\u201d:\n\nswitch(config)#management api gnmi\nswitch(config-mgmt-api-gnmi)#transport grpc default\nswitch(config-gnmi-transport-default)#no accounting requests\n\n\n\u00a0\n\nto disable logging for the OpenConfig agent, run:\n\nswitch(config)#no trace OpenConfig setting\n\n\n\u00a0\n\nOption 2 - disable the gNOI File service entirelyTo disable the gNOI File service, override the OCGNOIFileToggle, then restart OpenConfig to load the changes\n\nswitch#bash timeout 100 echo \"OCGNOIFileToggle=0\" >> /mnt/flash/toggle_override\nswitch#agent OpenConfig terminate \n\n\n\u00a0\n\nDisabling the gNOI File service will mean that gNOI clients will no longer be able to call any gNOI File RPCs\n\nOption 3 - block the TransferToRemote RPC using gNSI AuthzFor releases with gNSI Authz (EOS 4.31.0F and later releases), the TransferToRemote RPC can be blocked using gNSI Authz.\n\nFirst enable gNSI Authz service by adding the following config:\n\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n\n\nWhere [NAME] is the name of the running gNMI transport\n\nAdding this config will cause the named gNMI transport to reload.\n\nNext update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes:\n\nswitch#bash timeout 100 echo \"{\\\"name\\\":\\\"block gNOI TransferToRemote policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"allow_all\\\"}],\\\"deny_rules\\\":[{\\\"name\\\":\\\"no-one-can-use-gnoi-transfer-to-remote\\\",\\\"request\\\":{\\\"paths\\\":[\\\"/gnoi.file.File/TransferToRemote\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json && sleep 11\n\n\n\u00a0\n\nThis will cause attempts to run the TransferToRemote RPC to fail with a \u201cPermissionDenied\u201d error code."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-08T13:01:59.603974Z", "id": "CVE-2025-0936", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T13:02:27.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0936", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-08T13:01:59.603974Z"}}}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T13:02:17.684Z"}}], "cna": {"title": "On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly", "source": {"defect": ["BUG 1045796"], "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.33.0", "versionType": "custom", "lessThanOrEqual": "4.33.1"}, {"status": "affected", "version": "4.32.0", "versionType": "custom", "lessThanOrEqual": "4.32.3M"}, {"status": "affected", "version": "4.31.0", "versionType": "custom", "lessThanOrEqual": "4.31.5M"}, {"status": "affected", "version": "4.30.1F", "versionType": "custom", "lessThanOrEqual": "4.30.9M"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2025-0936 has been fixed in the following releases:\n\n * 4.30.10M and later releases in the 4.30.x train\n * 4.31.7M and later releases in the 4.31.x train\n * 4.32.5M and later releases in the 4.32.x train\n * 4.33.2F and later releases", "supportingMedia": [{"type": "text/html", "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\">EOS User Manual: Upgrades and Downgrades</a></p><div>CVE-2025-0936 has been fixed in the following releases:</div><ul><li>4.30.10M and later releases in the 4.30.x train</li><li>4.31.7M and later releases in the 4.31.x train</li><li>4.32.5M and later releases in the 4.32.x train</li><li>4.33.2F and later releases</li></ul><br>", "base64": false}]}], "datePublic": "2025-05-06T15:00:00.000Z", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117"}], "workarounds": [{"lang": "en", "value": "There are a number of possible workarounds:\n\nOption 1 - disable accounting/logging for the OpenConfig transportFor example to disable accounting for transport named \u201cdefault\u201d:\n\nswitch(config)#management api gnmi\nswitch(config-mgmt-api-gnmi)#transport grpc default\nswitch(config-gnmi-transport-default)#no accounting requests\n\n\n\u00a0\n\nto disable logging for the OpenConfig agent, run:\n\nswitch(config)#no trace OpenConfig setting\n\n\n\u00a0\n\nOption 2 - disable the gNOI File service entirelyTo disable the gNOI File service, override the OCGNOIFileToggle, then restart OpenConfig to load the changes\n\nswitch#bash timeout 100 echo \"OCGNOIFileToggle=0\" >> /mnt/flash/toggle_override\nswitch#agent OpenConfig terminate \n\n\n\u00a0\n\nDisabling the gNOI File service will mean that gNOI clients will no longer be able to call any gNOI File RPCs\n\nOption 3 - block the TransferToRemote RPC using gNSI AuthzFor releases with gNSI Authz (EOS 4.31.0F and later releases), the TransferToRemote RPC can be blocked using gNSI Authz.\n\nFirst enable gNSI Authz service by adding the following config:\n\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n\n\nWhere [NAME] is the name of the running gNMI transport\n\nAdding this config will cause the named gNMI transport to reload.\n\nNext update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes:\n\nswitch#bash timeout 100 echo \"{\\\"name\\\":\\\"block gNOI TransferToRemote policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"allow_all\\\"}],\\\"deny_rules\\\":[{\\\"name\\\":\\\"no-one-can-use-gnoi-transfer-to-remote\\\",\\\"request\\\":{\\\"paths\\\":[\\\"/gnoi.file.File/TransferToRemote\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json && sleep 11\n\n\n\u00a0\n\nThis will cause attempts to run the TransferToRemote RPC to fail with a \u201cPermissionDenied\u201d error code.", "supportingMedia": [{"type": "text/html", "value": "<p>There are a number of possible workarounds:</p><h4>Option 1 - disable accounting/logging for the OpenConfig transport</h4><p>For example to disable accounting for transport named \u201cdefault\u201d:</p><pre>switch(config)#management api gnmi\nswitch(config-mgmt-api-gnmi)#transport grpc default\nswitch(config-gnmi-transport-default)#<span style=\"background-color: rgb(255, 255, 0);\">no accounting requests</span>\n</pre><div>&nbsp;</div><p>to disable logging for the OpenConfig agent, run:</p><pre>switch(config)#no trace OpenConfig setting\n</pre><div>&nbsp;</div><h4>Option 2 - disable the gNOI File service entirely</h4><p>To disable the gNOI File service, override the OCGNOIFileToggle, then restart OpenConfig to load the changes</p><pre>switch#bash timeout 100 echo \"OCGNOIFileToggle=0\" &gt;&gt; /mnt/flash/toggle_override\nswitch#agent OpenConfig terminate \n</pre><div>&nbsp;</div><p>Disabling the gNOI File service will mean that gNOI clients will no longer be able to call any gNOI File RPCs</p><h4>Option 3 - block the TransferToRemote RPC using gNSI Authz</h4><p>For releases with gNSI Authz (EOS 4.31.0F and later releases), the TransferToRemote RPC can be blocked using gNSI Authz.</p><p>First enable gNSI Authz service by adding the following config:</p><pre>switch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n</pre><p>Where [NAME] is the name of the running gNMI transport</p><p>Adding this config will cause the named gNMI transport to reload.</p><p>Next update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes:</p><pre>switch#bash timeout 100 echo \"{\\\"name\\\":\\\"block gNOI TransferToRemote policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"allow_all\\\"}],\\\"deny_rules\\\":[{\\\"name\\\":\\\"no-one-can-use-gnoi-transfer-to-remote\\\",\\\"request\\\":{\\\"paths\\\":[\\\"/gnoi.file.File/TransferToRemote\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json &amp;&amp; sleep 11\n</pre><div>&nbsp;</div><p>This will cause attempts to run the TransferToRemote RPC to fail with a \u201cPermissionDenied\u201d error code.</p><br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc).", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc).</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "CWE-256"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2025-0936, one or both of the following conditions must be met:\n\n * OpenConfig must be enabled with a gNOI server with accounting enabled \n * OpenConfig must be enabled with a gNOI server with tracing enabled which includes any of:\n * service/9\n * interceptor/9 \n * transport_socketcli/9 \n\n\n\n\n\nIf OpenConfig is enabled with a gNOI server with accounting enabled, this will be shown in the following CLI output:\n\nswitch(config)#show management api gnmi\nTransport: default\nEnabled: yes\nServer: running on port 6030, in default VRF\nSSL profile: none\nQoS DSCP: none\nAuthorization required: no\nAccounting requests: yes\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n\n\n\u00a0\n\nIf OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.\n\nswitch(config)#show management api gnmi\nEnabled: no transports enabled\n\n\n\u00a0\n\nTo see the tracing enabled for OpenConfig, run:\n\nswitch(config)#show running-config section trace | grep OpenConfig\ntrace OpenConfig setting service/9,interceptor/9,transport_socketcli/9\n\n\n\u00a0\n\nNote: gRPC-based streaming via TerminAttr to CloudVision is not affected by this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<p>In order to be vulnerable to CVE-2025-0936, one or both of the following conditions must be met:</p><ul><li>OpenConfig must be enabled with a gNOI server with accounting enabled </li><li>OpenConfig must be enabled with a gNOI server with tracing enabled which includes any of:<br><ul><li>service/9</li><li>interceptor/9 </li><li>transport_socketcli/9 </li></ul></li></ul><p>If OpenConfig is enabled with a gNOI server with accounting enabled, this will be shown in the following CLI output:</p><pre>switch(config)#show management api gnmi\nTransport: default\nEnabled: <span style=\"background-color: rgb(255, 255, 0);\">yes</span>\nServer: running on port 6030, in default VRF\nSSL profile: none\nQoS DSCP: none\nAuthorization required: no\nAccounting requests: <span style=\"background-color: rgb(255, 255, 0);\">yes</span>\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n</pre><div>&nbsp;</div><p>If OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.</p><pre>switch(config)#show management api gnmi\nEnabled: <span style=\"background-color: rgb(255, 255, 0);\">no transports enabled</span>\n</pre><div>&nbsp;</div><p>To see the tracing enabled for OpenConfig, run:</p><pre>switch(config)#show running-config section trace | grep OpenConfig\ntrace OpenConfig setting <span style=\"background-color: rgb(255, 255, 0);\">service/9,interceptor/9,transport_socketcli/9</span>\n</pre><div>&nbsp;</div><p>Note: gRPC-based streaming via TerminAttr to CloudVision is not affected by this vulnerability.</p><br>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2025-05-07T22:52:25.444Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0936", "state": "PUBLISHED", "dateUpdated": "2025-05-08T13:02:27.046Z", "dateReserved": "2025-01-31T17:18:43.715Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2025-05-07T22:52:25.444Z", "assignerShortName": "Arista"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.33.1", "status": "affected", "version": "4.33.0", "versionType": "custom"}, {"lessThanOrEqual": "4.32.3M", "status": "affected", "version": "4.32.0", "versionType": "custom"}, {"lessThanOrEqual": "4.31.5M", "status": "affected", "version": "4.31.0", "versionType": "custom"}, {"lessThanOrEqual": "4.30.9M", "status": "affected", "version": "4.30.1F", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc)."}, {"lang": "es", "value": "En las plataformas afectadas que ejecutan Arista EOS con un transporte gNMI habilitado, ejecutar la RPC gNOI File TransferToRemote con credenciales para un servidor remoto puede provocar que estas credenciales del servidor remoto se registren o contabilicen en el dispositivo EOS local o posiblemente en otros servidores de contabilidad remotos (es decir, TACACS, RADIUS, etc.)."}], "id": "CVE-2025-0936", "lastModified": "2026-06-17T08:27:23.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0936", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-08T13:01:59.603974Z", "version": "2.0.3"}}]}, "published": "2025-05-07T23:15:53.010", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-256"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{}