Threat database

CVE-2025-3456 is a vulnerability in Arista Networks EOS where the global common encryption key configuration may be logged in clear text in local or remote accounting logs. This exposure could allow an attacker with access to these logs and the device running-config to derive protocol-specific passwords used for symmetric authentication between neighbor devices. The vulnerability affects multiple versions of EOS from 4.29.0 through 4.34.0F. The CVSS score is 3.8, indicating a low severity impact primarily on confidentiality.

n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to incorrectly be allowed or denied. The two symptoms of this issue on the affected release and platform are: * Packets which should be permitted may be dropped and, * Packets which should be dropped may be permitted.

EPSS 0.5%VulnerabilityArista Networks#cwe-1284Germany+6

On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal anti-replay protection, will instead be forwarded due to this vulnerability. Note: this issue does not affect VXLANSec or MACSec encryption functionality.

EPSS 0.2%VulnerabilityArista Networks#cwe-284Germany+6

On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries.

EPSS 0.3%VulnerabilityArista Networks#cwe-1189Germany+7

On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by authenticated users, as well as appear in clear text in the device’s running config.

EPSS 0.3%VulnerabilityArista Networks#cwe-212Germany+6