Vulnerabilities in Arista Networks

154 results
CVE-2025-8870MEDIUMOn affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.EPSS 0.2%CVE-2026-73459HIGHSecurity Advisory 0160EPSS 0.2%CVE-2024-9133MEDIUMA user with administrator privileges is able to retrieve authentication tokensEPSS 0.2%CVE-2026-73450HIGHSecurity Advisory 0161EPSS 0.2%CVE-2026-25624MEDIUMArista Edge Threat Management NGFW UI Administrative Cross-Site ScriptingEPSS 0.2%CVE-2024-6858MEDIUMIn Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.EPSS 0.1%CVE-2026-73466MEDIUMOn affected platforms running Arista EOS, under certain circumstances plaintext user passwordsEPSS 0.1%CVE-2026-73465MEDIUMOn affected platforms running Arista EOS, under certain circumstances plaintext private keysEPSS 0.1%CVE-2026-73467MEDIUMOn affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) serversEPSS 0.1%CVE-2025-54545HIGHOn affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.EPSS 0.1%CVE-2025-54547MEDIUMOn affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expiredEPSS 0.1%CVE-2025-3456LOWOn affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-cEPSS 0.1%CVE-2024-7142MEDIUMOn Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption might not be successfully performed. This results in the disks remaining unsecured and data on themEPSS 0.1%CVE-2025-54549MEDIUMCryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISOEPSS 0.1%