CVE-2025-5090

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5090", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2025-05-22T16:26:48.444Z", "datePublished": "2026-06-05T15:49:27.770Z", "dateUpdated": "2026-06-09T14:37:26.091Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-06-05T15:49:27.770Z"}, "title": "Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages", "datePublic": "2025-11-18T16:46:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS / CloudVision eXchange (CVX)", "platforms": ["CloudVision eXchange", "virtual or physical appliance"], "versions": [{"status": "affected", "version": "4.34.0F", "lessThanOrEqual": "4.34.1F", "versionType": "custom"}, {"status": "affected", "version": "4.33.0M", "lessThanOrEqual": "4.33.4M", "versionType": "custom"}, {"status": "affected", "version": "4.32.0M", "lessThanOrEqual": "4.32.6M", "versionType": "custom"}, {"status": "affected", "version": "4.31.0", "lessThan": "4.32.0", "versionType": "custom"}, {"status": "affected", "version": "4.30.0", "lessThan": "4.31.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.</p>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126", "tags": ["vendor-advisory"]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2025-5090, the following condition must be met: CVX must be configured:\n\n\n\n\ncvx1#show cvx\n Status: Enabled\n Mode: Standalone\n Heartbeat interval: 20.0\n Heartbeat timeout: 60.0\n Client connection state preserving: Disabled\n \ncvx1#show running-config section cvx\ncvx\n no shutdown", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2025-5090, the following condition must be met: CVX must be configured:</p>\n<pre><code>cvx1#show cvx\n Status: Enabled\n Mode: Standalone\n Heartbeat interval: 20.0\n Heartbeat timeout: 60.0\n Client connection state preserving: Disabled\n \ncvx1#show running-config section cvx\ncvx\n no shutdown</code></pre>"}]}], "workarounds": [{"lang": "en", "value": "There is no mitigation for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>There is no mitigation for this issue.</p>"}]}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2025-5090 has been fixed in the following releases:\n\n\n\n * 4.34.2F and later releases in the 4.34.x train\n\n * 4.33.5M and later releases in the 4.33.x train\n\n * 4.32.7M and later releases in the 4.32.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2025-5090 has been fixed in the following releases:</p>\n<ul>\n <li>4.34.2F and later releases in the 4.34.x train</li>\n <li>4.33.5M and later releases in the 4.33.x train</li>\n <li>4.32.7M and later releases in the 4.32.x train</li>\n</ul>"}]}], "source": {"defect": ["BUG1139764"], "advisory": "0126", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram"}, "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "x_capecAlignment": {"capecId": "CAPEC-125", "capecName": "Flooding / Malformed Packet", "justification": "An attacker with high privilege access over a downstream switch can emit unexpected or malformed TCP packets causing state management code on CVX (ControllerOob/Controllerdb) to throw unhandled faults, leading to ongoing client deregistration cycles and cluster instability."}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T14:08:56.120293Z", "id": "CVE-2025-5090", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:37:26.091Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5090", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:08:56.120293Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:09:28.208Z"}}], "cna": {"title": "Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages", "source": {"defect": ["BUG1139764"], "advisory": "0126", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS / CloudVision eXchange (CVX)", "versions": [{"status": "affected", "version": "4.34.0F", "versionType": "custom", "lessThanOrEqual": "4.34.1F"}, {"status": "affected", "version": "4.33.0M", "versionType": "custom", "lessThanOrEqual": "4.33.4M"}, {"status": "affected", "version": "4.32.0M", "versionType": "custom", "lessThanOrEqual": "4.32.6M"}, {"status": "affected", "version": "4.31.0", "lessThan": "4.32.0", "versionType": "custom"}, {"status": "affected", "version": "4.30.0", "lessThan": "4.31.0", "versionType": "custom"}], "platforms": ["CloudVision eXchange", "virtual or physical appliance"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2025-5090 has been fixed in the following releases:\n\n\n\n * 4.34.2F and later releases in the 4.34.x train\n\n * 4.33.5M and later releases in the 4.33.x train\n\n * 4.32.7M and later releases in the 4.32.x train", "supportingMedia": [{"type": "text/html", "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2025-5090 has been fixed in the following releases:</p>\n<ul>\n <li>4.34.2F and later releases in the 4.34.x train</li>\n <li>4.33.5M and later releases in the 4.33.x train</li>\n <li>4.32.7M and later releases in the 4.32.x train</li>\n</ul>", "base64": false}]}], "datePublic": "2025-11-18T16:46:00.000Z", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "There is no mitigation for this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>There is no mitigation for this issue.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram"}, "descriptions": [{"lang": "en", "value": "CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.", "supportingMedia": [{"type": "text/html", "value": "<p>CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2025-5090, the following condition must be met: CVX must be configured:\n\n\n\n\ncvx1#show cvx\n Status: Enabled\n Mode: Standalone\n Heartbeat interval: 20.0\n Heartbeat timeout: 60.0\n Client connection state preserving: Disabled\n \ncvx1#show running-config section cvx\ncvx\n no shutdown", "supportingMedia": [{"type": "text/html", "value": "<p>In order to be vulnerable to CVE-2025-5090, the following condition must be met: CVX must be configured:</p>\n<pre><code>cvx1#show cvx\n Status: Enabled\n Mode: Standalone\n Heartbeat interval: 20.0\n Heartbeat timeout: 60.0\n Client connection state preserving: Disabled\n \ncvx1#show running-config section cvx\ncvx\n no shutdown</code></pre>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-06-05T15:49:27.770Z"}, "x_capecAlignment": {"capecId": "CAPEC-125", "capecName": "Flooding / Malformed Packet", "justification": "An attacker with high privilege access over a downstream switch can emit unexpected or malformed TCP packets causing state management code on CVX (ControllerOob/Controllerdb) to throw unhandled faults, leading to ongoing client deregistration cycles and cluster instability."}}}, "cveMetadata": {"cveId": "CVE-2025-5090", "state": "PUBLISHED", "dateUpdated": "2026-06-09T14:37:26.091Z", "dateReserved": "2025-05-22T16:26:48.444Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2026-06-05T15:49:27.770Z", "assignerShortName": "Arista"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["CloudVision eXchange", "virtual or physical appliance"], "product": "EOS / CloudVision eXchange (CVX)", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.34.1F", "status": "affected", "version": "4.34.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.33.4M", "status": "affected", "version": "4.33.0M", "versionType": "custom"}, {"lessThanOrEqual": "4.32.6M", "status": "affected", "version": "4.32.0M", "versionType": "custom"}, {"lessThan": "4.32.0", "status": "affected", "version": "4.31.0", "versionType": "custom"}, {"lessThan": "4.31.0", "status": "affected", "version": "4.30.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX."}, {"lang": "es", "value": "CVX no es resiliente a mensajes inesperados de un switch conectado. Esto provoca ca\u00eddas de agentes en CVX, causando inestabilidad en el cl\u00faster de CVX. Un atacante podr\u00eda usar este comportamiento para crear un escenario de denegaci\u00f3n de servicio (DoS). Tenga en cuenta que esto requerir\u00eda que el atacante tuviera acceso de alto privilegio al switch conectado para poder enviar paquetes TCP personalizados al CVX."}], "id": "CVE-2025-5090", "lastModified": "2026-10-07T08:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5090", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T14:08:56.120293Z", "version": "2.0.3"}}]}, "published": "2026-06-05T17:16:30.347", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["cloudvision_exchange", "virtual_or_physical_appliance"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.34.0F,4.34.1F]"}}, {"platform": ["cloudvision_exchange", "virtual_or_physical_appliance"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.33.0M,4.33.4M]"}}, {"platform": ["cloudvision_exchange", "virtual_or_physical_appliance"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.32.0M,4.32.6M]"}}, {"platform": ["cloudvision_exchange", "virtual_or_physical_appliance"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.31.0,4.32.0)"}}, {"platform": ["cloudvision_exchange", "virtual_or_physical_appliance"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.30.0,4.31.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "EOS / CloudVision eXchange (CVX)", "source": "cna", "vendor": "Arista Networks"}, "product": "cloudvision_exchange", "vendor": "arista"}], "created": "2026-06-05T18:00:15.429140+00:00", "updated": "2026-06-07T11:16:27.496509+00:00", "vendors": ["arista", "arista$PRODUCT$cloudvision_exchange"]}