Eos / Cloudvision Exchange (Cvx)
Approved changes feed: RSS · Atom
cpe:2.3:a:arista_networks:eos_/_cloudvision_exchange_(cvx):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Arista Networks (a0182fe3-0447-5099-835f-342e87c54952) |
|---|---|
| Product | Eos / Cloudvision Exchange (Cvx) (ea0623fd-3c7e-5846-8223-675b7dab57cc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-5090 |
vulnerable | 2026-06-08 07:35:24.131923 |
Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages
MEDIUM (6.5)
CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.
Published: 2026-06-05T15:49:27.770Z
Updated: 2026-06-09T14:37:26.091Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5089 |
vulnerable | 2026-06-08 07:35:24.131746 |
Arista EOS SysDB Agent Denial of Service via Malformed CVX Client/Server Messages
MEDIUM (6.5)
In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. This leads to either a Sysdb agent crash on the EOS device causing a soft reset of the switch or agent crashes on the CVX server causing instability of the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to already have a high privilege access to the connected device to be able to send custom TCP packets. EOS switches that are not connected to a CVX server are not impacted.
Published: 2026-06-05T15:44:45.822Z
Updated: 2026-06-09T15:14:08.353Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5088 |
vulnerable | 2026-06-08 07:35:24.131491 |
Arista CloudVision Exchange (CVX) Cluster Privilege Escalation via MCS Redis Session
HIGH (8.3)
An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.
Published: 2026-06-05T15:58:15.288Z
Updated: 2026-06-09T14:37:20.098Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.