CVE-2025-1260

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Arista Networks	EOS	>= 4.33.0, <= 4.33.1; >= 4.32.0, <= 4.32.3; >= 4.31.0, <= 4.31.5; >= 4.30.0, <= 4.30.8; >= 4.29.0, <= 4.29.9; >= 4.28.0, <= 4.28.12

References

https://www.arista.com/en/support/advisories-notices/security-advisory/21098-security-advisory-0111

Timeline

Published: Mar 4, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-126009.8Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-126017.5Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-126029.8/etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-126039.8/etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-126049.8A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php.CVE-2025-126059.8A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loa CVE-2025-126069.8A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /ma CVE-2025-126079.8A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_paymen CVE-2025-126089.8A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the fi CVE-2025-126098.8A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/up CVE-2025-12615.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Cou CVE-2025-126107.2A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.