Information disclosure in Arista Networks Eos
CVE-2025-3456
On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.
EPSS: 0.001 (1.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.8 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.
Affected products
- Arista Networks Eos — versions 4.34.0F, 4.33.0, 4.32.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-3456?
- CVE-2025-3456 is a low-severity vulnerability in Arista Networks Eos, classified under Insertion of Sensitive Information into Log File. CVSS score: 3.8/10. Published 2025-08-25.
- How severe is CVE-2025-3456?
- Low severity. CVSS v3 base score is 3.8 out of 10.