Arista EOS/CVX CVE-2025-5089

The EOS switch must be actively enrolled in and connected to a CVX cluster - this is the mandatory deployment prerequisite, and the vendor explicitly states that standalone EOS switches not connected to a CVX server are unaffected. The attacker must possess high-privilege access to a device within the cluster trust boundary (either an EOS switch or the CVX server) to inject custom TCP packets into the CVX protocol stream; casual network proximity is insufficient. This high-privilege requirement is the primary limiting factor constraining exploitation to insider threats, compromised privileged accounts, or attackers who have already achieved significant foothold with elevated rights. Important caveat: the CVSS PR:L vector conflicts with the vendor's 'high privilege access' language - the precise privilege threshold required should be verified from Arista Advisory 0126 before using the CVSS vector as a sole basis for access control policy decisions.

The CVSS 6.5 (Medium) score is derived from a network-reachable (AV:N), low-complexity (AC:L), low-privilege (PR:L), no-user-interaction (UI:N) vector with high availability impact (A:H) and no confidentiality or integrity impact (C:N/I:N). However, a material discrepancy exists between the CVSS PR:L rating and the vendor description, which explicitly states that exploitation requires 'high privilege access to the connected device' to send custom TCP packets - defenders should not calibrate access control decisions solely on the PR:L score without verifying this conflict directly against Arista Security Advisory 0126. No EPSS score was provided in the available data. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, placing the real-world exploitation likelihood materially lower than the CVSS score alone suggests. The blast radius is limited to environments running an EOS-CVX cluster topology; standalone EOS switches are explicitly unaffected. The purely availability-focused impact (no data exposure or integrity loss) further constrains the operational severity for most organizations.

An attacker who has obtained or already holds high-privilege access to an EOS switch enrolled in a CVX cluster crafts malformed TCP messages conforming to the CVX protocol format and injects them toward either the CVX server or the target EOS switch's agent communication channel. The receiving agent fails to validate the malformed input, crashes, and triggers either a soft reset of the EOS switch or cascading agent failures across the CVX cluster - disrupting network availability for all devices managed by that cluster. No public proof-of-concept has been identified at time of analysis.