EUVD-2025-210077
GHSA-6vg3-4m6v-gqxx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.
AnalysisAI
Privilege escalation in Arista CloudVision Exchange (CVX) allows an authenticated attacker with network reach to the Redis service to obtain full root access across every server in the CVX cluster. The flaw stems from CVX's reliance on Redis for inter-node coordination combined with the fact that Redis traffic - including authentication - is transmitted in plaintext, meaning anyone who can sniff a single session can replay credentials to compromise the entire cluster. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Arista CVX is the clustering/state-exchange component of Arista EOS that distributes network state between control-plane nodes; it uses Redis as a shared coordination store. The weakness maps to CWE-269 (Improper Privilege Management) because an authenticated Redis client - which should be a narrowly scoped data-plane role - is effectively trusted to issue operations that result in root-equivalent control over CVX hosts. Compounding this design issue, CVX's current Redis deployment lacks TLS (tracked under Arista RFE1294850), so authentication tokens, commands, and responses traverse the network unencrypted, making credential capture trivial for any attacker positioned on the management or cluster-interconnect path.
RemediationAI
Patch status from the provided data is ambiguous - consult the Arista advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126 for fixed EOS/CVX versions and apply the vendor-recommended upgrade for your release train. As compensating controls until upgrade, restrict the Redis service port on CVX nodes to a dedicated, isolated management/cluster VLAN reachable only by authorized CVX peers and operators (trade-off: requires network segmentation changes and may break existing tooling that talks to Redis directly); enforce host-based firewall rules on CVX servers to deny Redis access from any address outside the cluster control plane; rotate the Redis password and tightly limit which operators hold it, recognizing that rotation alone does not solve plaintext exposure; and monitor for unexpected Redis client connections. Until the TLS work tracked under RFE1294850 ships, assume any network path carrying CVX Redis traffic is a credential-disclosure channel and treat it as a sensitive segment.
Privilege escalation to root in the LiteSpeed User-End cPanel Plugin (versions 2.3 through before 2.4.5) lets attackers
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
RESP protocol command injection in Predis, the popular PHP client for Redis and Valkey, affects versions 3.0.0-RC1 throu
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today