Medium severity · published Jun 5, 2026
CVE-2025-5089
Arista EOS SysDB Agent Denial of Service via Malformed CVX Client/Server Messages
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. This leads to either a Sysdb agent crash on the EOS device causing a soft reset of the switch or agent crashes on the CVX server causing instability of the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to already have a high privilege access to the connected device to be able to send custom TCP packets. EOS switches that are not connected to a CVX server are not impacted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
EOS / CloudVision eXchange (CVX) · Arista Networks
4.34.0F through 4.34.1F; 4.33.0M through 4.33.4M; 4.32.0M through 4.32.6M; 4.31.0M through 4.31.8M; 4.30.0 before 4.31.0 · source: vendor
Affected product
EC
EOS / CloudVision eXchange (CVX)
Arista Networks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5089
www.arista.com
https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126
More from EOS / CloudVision eXchange (CVX)
8.3
CVE-2025-5088
Arista CloudVision Exchange (CVX) Cluster Privilege Escalation via MCS Redis Session
6.5
CVE-2025-5090
Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages
