CVE-2025-5090

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Arista Networks	EOS / CloudVision eXchange (CVX)	>= 4.34.0F, <= 4.34.1F; >= 4.33.0M, <= 4.33.4M; >= 4.32.0M, <= 4.32.6M; >= 4.31.0, < 4.32.0; >= 4.30.0, < 4.31.0

References

https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126

Timeline

Published: Jun 5, 2026
Last modified: Oct 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-509009.8An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affect CVE-2025-509019.8JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbit CVE-2025-509028.8Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru 1.0.0 allows attack CVE-2025-509049.8There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulner CVE-2025-50926.4Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<=CVE-2025-509266.5Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the List All Emai CVE-2025-509276.3A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to CVE-2025-509284.8Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settin CVE-2025-50935.4The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes CVE-2025-509386.1Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.CVE-2025-509448.8An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X5 CVE-2025-509466.5OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.