Which versions of Arista CloudVision Exchange are affected by CVE-2025-5090?

Arista CloudVision Exchange (CVX) contains a denial-of-service vulnerability that allows attackers with administrative access to connected switches to crash CVX agents and destabilize the cluster.. A patch is available.

How to fix or mitigate CVE-2025-5090?

Within 24 hours: Verify which CVX versions are deployed in your environment using Arista security advisories; assess whether connected switches are managed by untrusted or external parties. Within 7 days: Implement network-level controls restricting unauthenticated TCP connections to CVX agents; enforce strict access controls limiting switch administrative privileges to personnel requiring them. Within 30 days: Monitor Arista's security pages for patch release; maintain detailed inventory of CVX deployments and switch interconnections for rapid patching once available; evaluate architectural changes to isolate CVX from less-trusted network segments.

Arista CloudVision Exchange CVE-2025-5090

Q: What is the CVSS score of CVE-2025-5090?

CVE-2025-5090 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-210076 HIGH

Improper Input Validation (CWE-20)

2026-06-05 Arista

GHSA-3hcx-j6wp-vh2q

Denial Of Service Eos Cloudvision Exchange Cvx

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 18:01 EUVD

Analysis Updated

Jun 05, 2026 - 17:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 05, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 05, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Jun 05, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

Jun 05, 2026 - 17:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 05, 2026 - 17:21 vuln.today

CVE Published

Jun 05, 2026 - 15:49 nvd

MEDIUM 6.5

DescriptionCVE.org

CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.

AnalysisAI

Denial of service in Arista CloudVision Exchange (CVX) allows an attacker with high-privilege access to a connected switch to crash CVX agents by sending malformed TCP packets, causing instability across the CVX cluster. The flaw stems from improper input validation (CWE-20) of messages received from connected switches, and no public exploit has been identified at time of analysis.

Technical ContextAI

CloudVision Exchange (CVX) is Arista's centralized network state controller that aggregates topology, MAC, and routing information from EOS-based switches across a fabric. CVX agents process control-plane messages exchanged over TCP with peered switches; CWE-20 (Improper Input Validation) here means the agent does not robustly handle malformed or unexpected message structures from a peer, and a single misbehaving (or attacker-controlled) switch can propagate an instability event into the controller. The affected CPE is cpe:2.3:a:arista_networks:eos_/_cloudvision_exchange_(cvx) - note Arista's advisory (SA-0126) should be consulted for the exact EOS/CVX release matrix.

RemediationAI

Patch available per vendor advisory: review Arista Security Advisory SA-0126 at https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126 and upgrade CVX/EOS to the fixed train specified there (no exact fixed version was provided in the multi-source data, so confirm the target release directly with Arista). Until upgrade, compensating controls include restricting which switches are permitted to peer with CVX (only trusted, fully managed fabric members), enforcing strict role-based access on EOS so that only a small, audited set of administrators hold the high-privilege role required to send arbitrary TCP traffic from a switch, segmenting the CVX control-plane network from general management VLANs, and monitoring CVX agent process health so that crashes are detected and the cluster can be failed over quickly - note that constraining peering can reduce dynamic state visibility for newly added switches and that aggressive process-restart watchdogs may mask the underlying issue rather than fix it.