CVE-2025-3456

Description

On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.

Remediation

Solution:

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-3456 has been fixed in the following releases: * 4.34.1F and later releases in the 4.34.x train * 4.33.4M and later releases in the 4.33.x train * 4.32.6M and later releases in the 4.32.x train * 4.31.8M and later releases in the 4.31.x train

Workaround:

There is no known mitigation for the issue. The recommended resolution is to upgrade to a remediated software version at your earliest convenience and afterwards rotate the custom global encryption-key.

N/A

CVSS

Severity:

EPSS 0.01%

Affected: Arista Networks EOS

References

Link	Tags
https://https://www.arista.com/en/support/advisories-notices/security-advisory/22022-security-advisory-0122

Frequently Asked Questions

What is the severity of CVE-2025-3456?: CVE-2025-3456 has not yet been assigned a CVSS score.
How to fix CVE-2025-3456?: To fix CVE-2025-3456: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-3456 has been fixed in the following releases: * 4.34.1F and later releases in the 4.34.x train * 4.33.4M and later releases in the 4.33.x train * 4.32.6M and later releases in the 4.32.x train * 4.31.8M and later releases in the 4.31.x train
Is CVE-2025-3456 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-3456 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-3456?: CVE-2025-3456 affects Arista Networks EOS.