EUVD-2025-210077
GHSA-6vg3-4m6v-gqxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to CVX network segment
-
DeliverySniff plaintext Redis authentication
-
ExploitConnect to Redis with captured credentials
-
ExecutionAbuse privileged Redis session on CVX node
-
PersistEscalate to root on CVX server
-
ImpactPivot across trusted cluster to all CVX hosts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network reachability to the Redis service port on a CVX server in an Arista EOS/CloudVision Exchange cluster, and (2) possession of the Redis password - explicitly noted by the vendor as the two prerequisites. Because Redis authentication on CVX occurs in plaintext (TLS support is not yet implemented and is tracked under Arista RFE1294850), the password requirement is effectively reduced to network-sniffing capability on any segment that carries CVX Redis traffic. Limiting factors: CVSS PR:L confirms authentication is required, no user interaction is needed, and exploitation is constrained to deployments running CVX clustering with Redis exposed beyond the trust boundary of the operator's management network. |
| Impact | The CVSS 4.0 score of 8.7 reflects network attack vector, low complexity, low privileges required, no user interaction, and high confidentiality/integrity impact with low availability impact (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:L). PR:L confirms an authenticated foothold is required, which materially limits opportunistic exploitation; however, because authentication credentials travel in plaintext over Redis, the practical barrier collapses for any attacker with passive network visibility to the CVX control plane. No EPSS score, KEV listing, SSVC decision, or public POC has been supplied in the input, so widespread exploitation cannot be inferred - this should be treated as a high-severity infrastructure issue meaningful to operators who expose CVX clustering traffic on shared or reachable networks, but not as an active mass-exploitation event. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on a network segment carrying CVX Redis traffic - for example a compromised jump host or a misconfigured management VLAN - passively captures the plaintext Redis authentication exchange, then connects to the Redis service on a CVX server using the captured password. From that authenticated Redis session the attacker leverages the privilege-management flaw to escalate to root on the targeted CVX node, and because the cluster trusts that node, pivots to obtain root on every other server in the CVX cluster. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jun 05, 2026
Privilege escalation in Arista CloudVision Exchange (CVX) allows an authenticated attacker with network reach to the Redis service to obtain full root access across every server in the CVX cluster. The flaw stems from CVX's reliance on Redis for inter-node coordination combined with the fact that Redis traffic - including authentication - is transmitted in plaintext, meaning anyone who can sniff a single session can replay credentials to compromise the entire cluster. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Earlier versions of this analysis (1)
Privilege escalation in Arista EOS CloudVision Exchange (CVX) allows an attacker with authenticated Redis access to obtain full root control over every server in the CVX cluster. The flaw is reachable by anyone holding the Redis password and network reachability to the Redis service, and is compounded by Redis communication occurring entirely in plaintext today. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Patch status from the provided data is ambiguous - consult the Arista advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126 for fixed EOS/CVX versions and apply the vendor-recommended upgrade for your release train. As compensating controls until upgrade, restrict the Redis service port on CVX nodes to a dedicated, isolated management/cluster VLAN reachable only by authorized CVX peers and operators (trade-off: requires network segmentation changes and may break existing tooling that talks to Redis directly); enforce host-based firewall rules on CVX servers to deny Redis access from any address outside the cluster control plane; rotate the Redis password and tightly limit which operators hold it, recognizing that rotation alone does not solve plaintext exposure; and monitor for unexpected Redis client connections. Until the TLS work tracked under RFE1294850 ships, assume any network path carrying CVX Redis traffic is a credential-disclosure channel and treat it as a sensitive segment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Arista CVX is the clustering/state-exchange component of Arista EOS that distributes network state between control-plane nodes; it uses Redis as a shared coordination store. The weakness maps to CWE-269 (Improper Privilege Management) because an authenticated Redis client - which should be a narrowly scoped data-plane role - is effectively trusted to issue operations that result in root-equivalent control over CVX hosts. Compounding this design issue, CVX's current Redis deployment lacks TLS (tracked under Arista RFE1294850), so authentication tokens, commands, and responses traverse the network unencrypted, making credential capture trivial for any attacker positioned on the management or cluster-interconnect path.
Know when Redis gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (Arista) · only source for this CVE.
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.
Executive ViewAI
Arista CloudVision Exchange contains a privilege escalation vulnerability allowing authenticated attackers with network access to its Redis service to obtain root control of the entire management cluster. This threatens the confidentiality, integrity, and availability of network infrastructure managed by CVX, as cluster compromise enables attackers to alter configurations, access managed devices, or disrupt operations across all coordinated systems.
Until vendor patch released: (1) Restrict Redis network access via firewall to administrative networks only; (2) Encrypt Redis traffic using VPN tunnel or TLS proxy; (3) Implement strong credential management with regular rotation and access logging; (4) Deploy network monitoring for anomalous Redis connections; (5) Maintain independent out-of-band access to managed infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
Authenticated Redis users with permission to run server-side Lua can trigger an integer overflow (CWE-190) in the bundle
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Authenticated Lua script execution in Redis 8.2.1 and earlier can be abused with a crafted long-string delimiter to trig
Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in
CVE-2025-46818 is a sandbox-escape flaw in Redis's embedded Lua scripting engine (all versions up to and including 8.2.1
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
Exploit-DB