CVE-2025-5090: CVX Agent Denial of Service Vulnerability

CVE-2025-5090 Overview

CVE-2025-5090 is an input validation flaw [CWE-20] affecting Arista CloudVision eXchange (CVX). The CVX service does not handle unexpected messages received from a connected switch. Malformed input triggers agent crashes on CVX, destabilizing the CVX cluster. An attacker with high-privilege access to a connected switch can craft custom TCP packets that produce a denial of service (DoS) condition. The issue is documented in Arista Security Advisory #0126.

Critical Impact
Repeated agent crashes destabilize the CVX cluster and disrupt centralized network state services that depend on it.

Affected Products

Arista CloudVision eXchange (CVX)
Switches connected to a CVX cluster
Refer to Arista Security Advisory #0126 for specific affected EOS and CVX versions

Discovery Timeline

2026-06-05 - CVE-2025-5090 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2025-5090

Vulnerability Analysis

CVX acts as a centralized service that exchanges state with connected EOS switches over TCP. The vulnerable code path does not validate or gracefully handle unexpected message structures arriving from a peer switch. When CVX receives a malformed or unexpected payload, an internal agent terminates. Repeated crashes propagate instability across the CVX cluster and interrupt services that rely on CVX for state distribution.

The weakness maps to [CWE-20] Improper Input Validation. The flaw is a logic-level parsing issue rather than a memory safety bug, and it does not yield code execution or data exposure. Impact is limited to availability of the CVX control plane.

Root Cause

The root cause is missing or insufficient validation of message types and fields received over the CVX-to-switch TCP channel. Inputs that fall outside the expected protocol state are not rejected cleanly, leading the agent to enter an unrecoverable error path and exit.

Attack Vector

Exploitation requires the attacker to already hold high-privilege access on a switch that is peered with CVX. From that vantage point, the attacker sends crafted TCP packets to the CVX endpoint. Because the network attack vector is reachable from any connected switch, a single compromised device is sufficient to disrupt the cluster. No user interaction is required on the CVX side.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.049%, reflecting low predicted exploitation activity.

Detection Methods for CVE-2025-5090

Indicators of Compromise

Unexpected restarts or crash logs from CVX agents on cluster nodes
Loss of CVX cluster quorum or repeated leader re-election events
Abnormal TCP traffic patterns from a peered switch toward the CVX management interface
Switch syslog entries showing privileged configuration or shell access prior to CVX instability

Detection Strategies

Monitor CVX agent process supervision logs for repeated termination and restart cycles.
Correlate switch authentication events with subsequent CVX agent crashes to identify a malicious peer.
Inspect TCP sessions between switches and CVX for malformed or out-of-state messages.

Monitoring Recommendations

Ingest CVX and EOS logs into a centralized SIEM or data lake for cross-correlation of switch privilege events with CVX availability.
Alert on any privileged shell access or configuration change on switches peered to CVX.
Track CVX cluster health metrics and trigger alerts on agent restart thresholds.

How to Mitigate CVE-2025-5090

Immediate Actions Required

Review the Arista Security Advisory #0126 for fixed EOS and CVX release versions and upgrade affected nodes.
Audit privileged accounts on all switches peered with CVX and remove unused credentials.
Restrict administrative access to switches using TACACS+ or RADIUS with multi-factor authentication.

Patch Information

Arista has published remediation guidance and fixed versions in Arista Security Advisory #0126. Apply the vendor-supplied EOS or CVX update that corresponds to your deployed release train.

Workarounds

Limit which switches are authorized to peer with CVX through network segmentation and ACLs on the CVX management interface.
Enforce least-privilege access on switch CLI and API to reduce the number of accounts capable of sending arbitrary TCP traffic to CVX.
Monitor CVX agent health and automate failover to a healthy cluster member when crashes are detected.

bash

# Example ACL restricting CVX TCP access to known switch management addresses
ip access-list CVX-PEERS
   permit tcp 10.0.10.0/24 host 10.0.20.5 eq 9979
   deny   tcp any host 10.0.20.5 eq 9979 log
   permit ip any any