Vulnerability · Published Jun 5, 2026 · Assigned by Arista

CVE-2025-5090Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages

Medium 6.5

In plain English

A medium-severity improper input validation in EOS / CloudVision eXchange (CVX) from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.

Affected products (as reported)

Vendor	Product	Versions
Arista Networks	EOS / CloudVision eXchange (CVX)	4.34.0F – through 4.34.1F4.33.0M – through 4.33.4M4.32.0M – through 4.32.6M4.31.0 – before 4.32.04.30.0 – before 4.31.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126 vendor-advisory