Improper Validation of Syntactic Correctness of Input in Arista Extensible Operating System (EOS) and Arista CloudEOS VM - CVE-2025-8873
Published: April 15, 2026
Vulnerability identifier: #VU126171
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-8873
CWE-ID: CWE-1286
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of syntactic correctness of input in the IPsec dataplane processing pipeline when processing a specially crafted packet. A remote attacker can send a specially crafted packet to cause a denial of service.
Only systems with IPsec configured are vulnerable. Non-IPsec traffic and IPsec traffic not originating or terminating on the system are not affected.
Affected software
Arista Extensible Operating System (EOS)
Arista CloudEOS VM
Arista CloudEOS VM
How to mitigate CVE-2025-8873
Install security update from vendor's website.
Arista Extensible Operating System (EOS) - addressed in versions 4.32.7M, 4.33.5M
Arista CloudEOS VM - addressed in versions 4.32.7M, 4.33.5M
Arista CloudEOS VM - addressed in versions 4.32.7M, 4.33.5M