CVE-2025-3456— On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c
Possible ATT&CK Techniques 1AI
T1552.004 · Private KeysGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-3456
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c
Source: CVE Program / CVE List V5
Vulnerability Description
On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Arista EOS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Arista EOS是美国Arista公司的一个完全可编程的、高度模块化的、基于Linux的网络操作系统。 Arista EOS存在安全漏洞，该漏洞源于全局通用加密密钥配置可能以明文形式记录，可能导致协议特定密码泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Arista Networks | EOS | 4.34.0F | - |
II. Public POCs for CVE-2025-3456
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-3456
请登录查看更多情报信息。
Other References for CVE-2025-3456 (1)
IV. Related Vulnerabilities
Same product: EOS
- CVE-2026-2379
Arista EOS IPsec Tunnel Sequence Number Mismatch via Interfa - CVE-2026-7473
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forw - CVE-2025-8873
Arista EOS Dataplane Denial of Service via Malformed IPsec P - CVE-2023-5502
On affected platforms running Arista EOS with 802.1x authent - CVE-2024-27892
On affected platforms running Arista EOS with OpenConfig con
Same vendor: Arista Networks
- CVE-2026-17191
VeloCloud Orchestrator Flow Metrics API SQL Injection - CVE-2026-17192
VeloCloud Orchestrator Missing Input Validation SSRF - CVE-2026-16812
VeloCloud Orchestrator OS Command Injection - CVE-2026-25624
Arista Edge Threat Management NGFW UI Administrative Cross-S - CVE-2026-25623
Arista Edge Threat Management NGFW UI Arbitrary Command Exec
Same weakness: CWE-532
- CVE-2026-75057
IntelliJ IDEA<2026.1.5 明文存储Git凭证 - CVE-2026-59911
Dell ObjectScale <4.3.0.1 日志注入致信息泄露 - CVE-2026-74870
openssl_encrypt before 1.4.8 Hardware Pepper Information Dis - CVE-2026-19483
The following vulnerabilities that can affect IBM Storage Sc - CVE-2026-18097
IBM® Db2® federated server could allow a local attacker to o
V. Comments for CVE-2025-3456
No comments yet