Arista CloudVision Exchange CVE-2025-5090

The attacker must already possess high-privilege access on an Arista switch that is configured to peer with the targeted CVX cluster, sufficient to originate custom TCP packets from that switch toward CVX - this typically means a compromised enable/admin credential or insider access on a fabric member. Exploitation is further limited to environments that actually deploy CVX (EOS without CVX is not the target), requires network reachability from the malicious switch to the CVX control-plane interface, and produces only availability impact (no confidentiality or integrity loss). No user interaction is needed once the attacker controls the peered switch.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H scores 7.1 and reflects a pure availability impact with low attacker complexity but requiring some privileges - consistent with the description's stipulation that the attacker must already have high-privilege access on a connected switch to craft and send the custom TCP packets. There is a notable inconsistency worth flagging: CVSS reports PR:L (low privileges) while the description explicitly states 'high privilege access to the connected switch' is required - defenders should treat the higher bar described by Arista as authoritative. No EPSS score, KEV listing, or POC was provided, and the issue is not flagged as actively exploited, so realistic risk is bounded by the strong precondition (compromise of, or insider access to, a peered switch) rather than internet-reachable abuse. For organizations using CVX as a single fabric control point, the cluster-wide instability potential still warrants prompt patching.

An insider or attacker who has already compromised a switch account with high privileges crafts and sends malformed TCP packets toward the CVX controller's management address; the CVX agent fails to validate the unexpected message structure and crashes, and as cluster members propagate state the instability spreads, leaving the fabric without a functioning state controller. No public exploit code is known at time of analysis.