CVE-2025-54547

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Arista Networks	DANZ Monitoring Fabric	0; <= DMF 8.6.1; <= DMF 8.5.2; <= CCF 6.2.4; <= CVA 7.0; <= MCD 2.4.0

References

https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124

Timeline

Published: Oct 29, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-545484.3On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)CVE-2025-545495.9Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO CVE-2025-54558.4An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentiall CVE-2025-545508.1The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that co CVE-2025-545514.3Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. I CVE-2025-545545.3tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the unde CVE-2025-545584.1OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.CVE-2025-545593.7An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for l CVE-2025-54567.5A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gatewa CVE-2025-545603.8A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which CVE-2025-545614.3An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which a CVE-2025-545624.3A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Informatio