CVE-2025-3456

LowCVSS 3.8/10Last modified Oct 12, 2026

Description

On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Arista Networks	EOS	4.34.0F; >= 4.33.0, <= 4.33.3F; >= 4.32.0, <= 4.32.5M; >= 4.31.0, <= 4.31.7M; >= 4.30.0, <= 4.30.10M; >= 4.29.0, <= 4.29.10M

References

https://www.arista.com/en/support/advisories-notices/security-advisory/22022-security-advisory-0122

Timeline

Published: Aug 25, 2025
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-34575.4The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions CVE-2025-34585.4The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to CVE-2025-34597.8The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance o CVE-2025-34607.8The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of C CVE-2025-34619.8The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication CVE-2025-34628.4"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in AS CVE-2025-34639.4"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulne CVE-2025-34648.4A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leadin CVE-2025-34657.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This i CVE-2025-34667.2langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full CVE-2025-34675.4An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows a CVE-2025-34685.4The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th