This vulnerability (CVE-2025-8873) in Arista EOS arises from improper validation of syntactic correctness of input related to IPsec processing. When IPsec is configured, a specially crafted packet can cause the dataplane to cease processing all IPsec traffic. The control plane may detect this and try to reset the IPsec pipeline, but traffic may still fail to resume. The issue does not affect non-IPsec traffic or IPsec traffic that does not originate or terminate on the device. The affected versions are 4.29.0M through 4.33.0M. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). There is no vendor advisory or patch information available at this time.

The vulnerability causes a denial of service condition for IPsec traffic processed by the affected Arista EOS devices. This results in the dataplane stopping IPsec traffic processing, potentially disrupting secure communications that rely on IPsec through the device. Non-IPsec traffic and IPsec traffic not terminating or originating on the device remain unaffected. There is no confidentiality or integrity impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates. No specific mitigations are provided in the current data. Avoid exposure of vulnerable devices to untrusted networks if possible, as the attack vector is network-based.