CVE-2025-2796: Arista Networks EOS · Improper Access Control
Affects Arista Networks EOSSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Arista Networks EOS | Affected
| Fixed in– |
AI-suggested
European organizations should first inventory their network infrastructure to identify Arista EOS devices running version 4.33.0 with hardware IPsec and anti-replay protection enabled. Until a vendor patch is released, administrators should consider temporarily disabling IPsec anti-replay protection if operationally feasible and if it does not violate security policies, or alternatively, implement additional network-level protections such as ingress filtering and strict packet validation to detect and block replayed packets. Monitoring network traffic for unusual duplicate encrypted packets could help detect exploitation attempts. Network segmentation and limiting exposure of IPsec endpoints to untrusted networks can reduce attack surface. Organizations should maintain close contact with Arista Networks for timely patch releases and apply updates promptly once available. Additionally, reviewing and hardening IPsec configurations, including key management and replay window settings, may mitigate risk. Finally, integrating anomaly detection systems that can identify replay attacks at the network layer will provide an additional defense.
Description
On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal anti-replay protection, will instead be forwarded due to this vulnerability. Note: this issue does not affect VXLANSec or MACSec encryption functionality.