Inclusion of Sensitive Information in Log Files in Arista Extensible Operating System (EOS) - CVE-2025-3456
Published: July 22, 2025
Vulnerability identifier: #VU113162
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2025-3456
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.
Affected software
Arista Extensible Operating System (EOS)
How to mitigate CVE-2025-3456
Install updates from vendor's website.
Arista Extensible Operating System (EOS) - addressed in versions 4.31.8M, 4.32.6M, 4.33.4M, 4.34.1F