CVE-2025-8873 is an improper validation of syntactic correctness vulnerability (CWE-1286) in Arista Networks EOS when IPsec is configured. A specially crafted packet can cause the dataplane to stop processing all IPsec traffic. Although the control plane may detect this and attempt to reset the IPsec processing pipeline, traffic may not resume afterward. The vulnerability does not impact non-IPsec traffic or IPsec traffic that does not originate or terminate on the affected system. This issue affects EOS versions 4.29.0M through 4.33.0M. No official remediation or patch information is provided in the available data.

The vulnerability results in a denial of service for IPsec traffic on affected devices, causing the dataplane to stop processing such traffic. This can disrupt secure communications relying on IPsec. There is no impact on non-IPsec traffic or IPsec traffic not terminating or originating on the device. The control plane's attempt to reset the IPsec pipeline may not restore traffic flow, prolonging the disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor Arista Networks' advisories for updates. Until a patch is available, consider limiting exposure of IPsec-configured EOS devices to untrusted networks or applying network-level controls to detect and block malformed packets targeting IPsec processing.