Arista EOS CVE-2025-54548

Requires a valid but low-privilege ('restricted') user account on the affected Arista platform, per PR:L in the CVSS vector. The specific enabling condition is access to a debug API endpoint that improperly returns configuration-database contents (including user password hashes) to accounts that should not have that visibility. Limiting factors: exploitation is impossible for fully unauthenticated attackers, is read-only (no integrity/availability impact), and depends on the debug API being reachable to the restricted account; environments that do not provision restricted/limited accounts or that restrict debug-API exposure face materially lower risk.

This is a moderate-risk information disclosure flaw, not an urgent priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable, low-complexity attack that nonetheless requires an authenticated low-privileged ('restricted') account and yields only limited confidentiality impact with no integrity or availability effect. The EPSS score is low (0.22%, 12th percentile), consistent with no public exploit identified at time of analysis and no CISA KEV listing, so there is no public exploit identified at time of analysis and exploitation is not known to be automatable or widespread. One nuance worth verifying: although the vendor rates confidentiality as C:L, the description explicitly states that user password hashes are exposed - credential-hash disclosure can enable downstream offline cracking and privilege escalation, which arguably warrants a higher confidentiality rating than C:L. Net assessment: a real but second-tier issue whose severity is capped by the need for an existing restricted account and the read-only nature of the exposure; patch on a normal cycle, prioritizing systems where many low-privilege accounts exist.

A restricted/low-privilege user already authenticated to an affected Arista platform invokes a debug API endpoint that returns portions of the configuration database it should not be able to read. The response discloses sensitive material such as local user password hashes, which the attacker can then subject to offline cracking to recover credentials and escalate privileges. No public exploit code is identified at time of analysis, and the attack requires valid low-privilege credentials.