Arista EOS CVE-2025-6978
HIGHVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate-to-elevated priority issue whose signals partially conflict. The CVSS 3.1 base score of 7.2 (High) derives from AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - a network-reachable, low-complexity flaw with full confidentiality, integrity, and availability impact, but requiring HIGH privileges (PR:H), which substantially gates exploitation to already-authenticated privileged operators. Counterbalancing that, the EPSS score is notably elevated at 13.43% (96th percentile), which is unusually high for a PR:H vulnerability and suggests either active scanner/exploit interest or an EPSS model signal worth monitoring. No CISA KEV listing is present in the input and no public exploit is indicated, so there is no public exploit identified at time of analysis and no confirmed active exploitation. The tension to flag explicitly: EPSS is high (96th percentile) despite PR:H and no KEV/POC evidence - this likely reflects the CWE-78 command-injection class (historically weaponizable) rather than confirmed in-the-wild activity, so treat the EPSS figure as a watch signal, not proof of exploitation. No SSVC decision data was provided. Overall: prioritize for patching on privileged-management-plane devices, but the PR:H barrier means this is not a drive-by unauthenticated threat. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated, high-privileged remote attackers can inject operating system commands through diagnostics functionality in Arista EOS, potentially achieving full compromise of confidentiality, integrity, and availability. CVE-2025-6978 carries a CVSS base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and an EPSS score of 13.43% (96th percentile), indicating elevated exploitation likelihood; however, no public exploit code and no CISA KEV active exploitation have been identified at time of analysis. Our independent assessment considers this a moderate-to-elevated priority issue with partially conflicting signals, and the vendor has published Arista security advisory 0123.
RemediationAI
No specific patch version or patch availability status was provided in the input data; consult Arista security advisory 0123 for the authoritative fixed version and upgrade instructions. Because exploitation requires high privileges (PR:H) and network access (AV:N), the most actionable near-term mitigation is to restrict access to diagnostics functionality and management interfaces to fully trusted administrators, using ACLs, firewall rules, or out-of-band management networks. Trade-offs include reduced remote administrative convenience and potential operational impact if diagnostics are needed for troubleshooting. If diagnostics commands are not essential, consider disabling or restricting them, accepting the trade-off of reduced troubleshooting capability. Since EPSS is 13.43% (96th percentile), prioritize patch deployment when available, and monitor logs for suspicious diagnostics command usage.
Affected ProductsAI
The affected product is Arista EOS (Extensible Operating System), as indicated by the vendor advisory. No CPE strings or version ranges were included in the provided intelligence. The exact affected and fixed versions are detailed in Arista security advisory 0123, available at https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123 (note the reference URL in the input contains a duplicated 'https://' prefix). Administrators should consult the advisory to determine whether their deployed EOS versions are impacted.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a command injection flaw (CWE-78) in the diagnostics subsystem of Arista EOS. Diagnostics commands are typically used for troubleshooting and may invoke underlying operating system shell commands; insufficient input sanitization allows an attacker with high privileges (PR:H) to inject arbitrary OS commands over the network (AV:N). This results in complete loss of confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected device. The specific affected versions and the exact diagnostics command(s) are not detailed in the provided data, but the vendor's advisory (Arista security advisory 0123) should contain the precise CPE and version information.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (arista) · only source for this CVE.
CVSS VectorVendor: arista
DescriptionCVE.org
Diagnostics command injection vulnerability
Executive ViewAI
A high-severity security flaw in Arista EOS could enable an authenticated, high-privileged remote attacker to undermine the confidentiality, integrity, and availability of critical network infrastructure. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; however, the elevated exploitation likelihood signaled by its EPSS score means leadership should prioritize risk assessment and interim controls. Network operations, security teams, and dependent business services are most affected.
No vendor-released patch identified at time of analysis; restrict diagnostics interface to trusted management networks, enforce least privilege for high-privileged accounts, monitor for unauthorized command execution, and follow Arista security advisory 0123 for updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB