Arista EOS
CVE-2025-54549
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged/local access to upgrade media
-
DeliveryDrop crafted file into upgrade ISO
-
ExploitAdmin initiates upgrade from ISO
-
ExecutionBypass cryptographic image validation (CWE-347)
-
PersistInstall unsigned/malicious firmware
-
ImpactPersistent integrity compromise of device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires the ability to place a specifically crafted file into the upgrade ISO used for the device software upgrade, plus an administrator actually performing an upgrade from that tampered ISO. Limiting factors are significant: the attack vector is local (AV:L), it requires some privilege (PR:L) to stage the upgrade media, and it requires user interaction (UI:R) because the malicious ISO only takes effect when an operator runs the upgrade - it cannot be triggered remotely or passively. There is no confidentiality or availability impact; the payoff is acceptance of an unsigned/malicious upgrade image (I:H, scope-changed). |
| Impact | This is a moderate, config/operator-dependent integrity flaw, not an urgent remote-exploitation priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N, 5.9) describes a LOCAL attack requiring low privileges AND user interaction - an administrator must actually initiate an upgrade using the tampered ISO - so it cannot be triggered remotely or against a passive target. EPSS is effectively floor-level (0.09%, 0th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so all signals point to low real-world exploitation likelihood: no public exploit identified at time of analysis. The one serious dimension is impact: successful bypass of upgrade-image signature validation (CWE-347) yields I:H with a scope change, meaning an attacker can install unsigned/malicious firmware that persists and controls the device. Signals are consistent (low exploitability, high integrity impact) with no major contradiction; the chief caveat is that the input Tags ('Information Disclosure', 'Jwt Attack') conflict with the actual CVSS vector (C:N, no confidentiality impact; no JWT component in the description) and should be disregarded in favor of the signature-verification-bypass characterization. |
| Exploit ScenarioDerived | A low-privileged operator or an attacker who can stage the upgrade media places a specifically crafted file into the upgrade ISO so that the device's cryptographic validation of the upgrade image is bypassed. When an administrator subsequently runs the upgrade from that ISO (the required user interaction), an unsigned or malicious image is accepted and installed. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Cryptographic validation of Arista EOS software upgrade images can be bypassed when a specifically crafted file is dropped into the upgrade ISO, allowing a tampered image to be accepted as genuine because integrity checking does not fail closed. The flaw is local and operator-dependent: an attacker must already have write access to stage content on the upgrade media (PR:L) and an administrator must then actually run the upgrade from that tampered ISO (UI:R), as reflected in CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N (5.9). There is no confidentiality or availability impact - the payoff is integrity loss (I:H) with a scope change, meaning the compromised image can influence components beyond the upgrade process itself; no public exploit code has been identified at time of analysis and the EPSS score is negligible (0.09%, 0th percentile), so this is a moderate, config/operator-dependent integrity issue rather than an urgent remote-exploitation priority.
RemediationAI
The primary fix is to apply the patched EOS release specified in Arista security advisory 0124 (https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124); no exact fix version was supplied in the provided data, so the advisory's fixed-release matrix must be read before upgrading. Until devices are patched, treat the tamper-resistance of upgrade media as unproven and apply compensating controls: verify every upgrade ISO against Arista-published SHA-256/MD5 hashes and image signatures obtained out-of-band from the vendor portal rather than from the same channel that delivered the ISO (this does not detect a file added after hashing, so hashing and installation should be done on the same untouched copy), and where the platform supports it compare the on-device image checksum against the vendor-listed value before committing the upgrade. Restrict and audit write access to upgrade servers, USB/removable media, and TFTP/SCP/HTTP staging locations so that only a small set of administrators can place files into an ISO, accepting the operational cost of tighter change control; a stronger measure is to stop using file-drop upgrade staging entirely in favour of a signed repository with per-image verification against Arista's public keys, though this requires provisioning PKI material on the management infrastructure and may not be supported on all legacy EOS versions. Because exploitation requires an operator to run the tampered upgrade, requiring a second-person review of upgrade media provenance immediately before maintenance windows is a cheap, low-side-effect procedural control that breaks the UI:R precondition for a would-be attacker.
Affected ProductsAI
The affected product is Arista EOS as deployed on switches and routers that are upgraded from ISO upgrade images, per Arista security advisory 0124 (https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124). No CPE identifiers or explicit version ranges were included in the provided intelligence, so the advisory itself must be consulted to determine exactly which EOS releases and platforms contain the faulty image-validation logic; the affected scope is defined functionally as any EOS build whose upgrade-image verification can be satisfied by a crafted file added to the upgrade ISO, and the reporter of record is Arista's own PSIRT (psirt@arista.com), indicating a vendor-acknowledged issue rather than a third-party report.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying issue is CWE-347, Improper Verification of Cryptographic Signature, applied to the EOS upgrade-image pipeline. Arista devices install system software from ISO-style upgrade media that contains signed images; the validation logic is expected to bind the trusted signature to the exact set of artifacts consumed by the installer. Because the check can be circumvented by introducing a specifically crafted additional file into the ISO, the routine does not fail closed and the installer can proceed with content that was never covered by the vendor signature. The CVSS vector confirms the attack surface: AV:L (the malicious file must be placed onto local/removable upgrade media), PR:L (the actor needs a privilege level sufficient to modify that media), UI:R (an operator must initiate the upgrade), and S:C (the scope change indicates the bypassed validation affects components beyond the vulnerable validation routine, so trust fails outside the originally expected authorization boundary). The supplied tag metadata references "Information Disclosure" and "Jwt Attack"; neither is corroborated by the advisory description or the assessed vector, which describe a local upgrade-image signature-verification bypass with integrity-only impact and no confidentiality effect, so those tags should be treated as unverified classification noise rather than evidence of a JWT or data-exposure component.
Know when Arista gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Local staging of upgrade media (AV:L, PR:L) that only succeeds when an admin runs the upgrade (UI:R); bypassing signed-image validation yields high integrity impact with scope change, no C/A impact.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
DescriptionCVE.org
Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly oth
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential d
GitHub PoC
Exploit-DB