Arista EOS CVE-2025-54547

Exploitation requires that SSH session multiplexing be explicitly configured on the client side (a non-default setting) so that scp/sftp sessions are multiplexed onto the same control channel; those multiplexed sessions can then perform file-system operations after the configured session timeout has expired, bypassing intended session expiration. Limiting factors: the attacker must already be an authenticated, low-privileged SSH user (PR:L) with local access (AV:L), the multiplexing configuration must be in place, and the flaw only manifests on the specific affected Arista platforms/versions - so default deployments without client-side multiplexing are not exposed.

This is a medium-severity (CVSS 5.3) session-expiration flaw (CWE-613) reported by Arista's own PSIRT. All signals point to low real-world priority rather than an urgent threat: the CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, meaning local access and existing low-level privileges (an already-authenticated SSH user) are required, with only partial Confidentiality/Integrity/Availability impact. EPSS is very low (0.11%, 1st percentile), there is no CISA KEV listing, and no public exploit was identified - three independent signals that converge on low likelihood of exploitation. The limiting factor is significant: exploitation depends on SSH client-side session multiplexing being explicitly configured, which is a non-default condition. There are no conflicting signals here - the low CVSS, low EPSS, and absence of KEV/POC are mutually consistent. The main data gap is that exact affected platforms and fixed versions are not in the provided data (they reside in the Arista advisory, which could not be retrieved), so version-level remediation details should be confirmed directly with the vendor advisory.

An authenticated user establishes an SSH connection to an affected Arista platform with client-side session multiplexing configured, then opens scp/sftp sessions multiplexed onto the same control channel. After the configured session timeout expires - when the session should no longer be valid - the multiplexed sessions can still perform file-system operations, extending access beyond the intended expiration. No public exploit code is identified, and the local attack vector plus required privileges keep complexity realistic only for an already-present user.