CVE-2025-5090
Medium
Description
CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.
SeverityMedium
CVSS6.5
Exploit probability—
ProductEOS / CloudVision eXchange (CVX)
PublishedJun 5, 2026
First seenJun 5, 2026
Weakness typeCWE-20Improper input validation
How to fix
Update
- Arista Networks EOS / CloudVision eXchange (CVX)4.32.0, 4.31.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Arista Networks EOS / CloudVision eXchange (CVX) | 4.34.0F ≤ v ≤ 4.34.1F, 4.33.0M ≤ v ≤ 4.33.4M, 4.32.0M ≤ v ≤ 4.32.6M, 4.31.0 ≤ v < 4.32.0, 4.30.0 ≤ v < 4.31.0 | 4.32.0, 4.31.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.