Arista EOS CVE-2025-54545

Exploitation requires an existing restricted (low-privilege, authenticated per PR:L) user account with CLI access on the affected Arista platform; the attacker leverages the CLI sandbox to break out into the underlying system shell and elevate privileges. Limiting factors: access is LOCAL only (AV:L), so no remote/network exploitation is possible, and the attacker must already possess valid restricted CLI credentials - this confines realistic risk to malicious insiders or attackers who have already obtained a limited foothold, rather than unauthenticated external actors. No user interaction is required (UI:N) and complexity is low (AC:L), so once restricted access is held the breakout is straightforward.

This is a locally-exploitable privilege escalation via CLI sandbox breakout, scored 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - meaning an attacker needs local access and existing low-privilege (restricted/authenticated) credentials, but no user interaction, and gains full confidentiality, integrity, and availability impact once the sandbox is escaped. The attack vector is LOCAL, not network, so this is not a remotely wormable mass-exploitation issue; it requires an attacker to already hold a restricted CLI account on the device, which bounds the realistic threat to insiders or an attacker who has already gained a foothold with limited credentials. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or probable exploitation - consistent with a privilege-escalation primitive that depends on prior access rather than a widely-scanned remote flaw. The CWE-732 (incorrect permission assignment) classification aligns with the sandbox-breakout description. Note a metadata conflict: the single tag is 'Information Disclosure,' but the described impact is sandbox escape and privilege elevation to a system shell, not primarily disclosure - the CVSS confidentiality impact is only one of three equal High impacts.

An attacker who already holds a restricted CLI user account on an affected Arista platform (for example a limited operator or a compromised low-privilege login) issues commands that escape the constrained CLI sandbox and drop into the underlying system shell, then elevates to full privileges. Because the CVSS vector is AV:L/AC:L/PR:L with no user interaction, exploitation is reliable once local restricted access exists. No public exploit code was identified in the provided data.