On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c
Summary
| CVE | CVE-2025-3456 |
|---|---|
| State | PUBLISHED |
| Assigner | Arista |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-08-25 20:15:39 UTC |
| Updated | 2026-10-12 10:16:41 UTC |
| Description | On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships. |
Risk And Classification
Primary CVSS: v3.1 3.8 LOW from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS: 0.001050000 probability, percentile 0.010130000 (date 2026-10-12)
Problem Types: CWE-532 | CWE-532 CWE-532 Insertion of Sensitive Information into Log File
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 3.8 | LOW | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| 3.1 | CNA | CVSS | 3.8 | LOW | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Arista Networks | EOS | affected 4.34.0F custom | EOS |
| CNA | Arista Networks | EOS | affected 4.33.0 4.33.3F custom | EOS |
| CNA | Arista Networks | EOS | affected 4.32.0 4.32.5M custom | EOS |
| CNA | Arista Networks | EOS | affected 4.31.0 4.31.7M custom | EOS |
| CNA | Arista Networks | EOS | affected 4.30.0 4.30.10M custom | EOS |
| CNA | Arista Networks | EOS | affected 4.29.0 4.29.10M custom | EOS |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.arista.com/en/support/advisories-notices/security-advisory/22022-securit... | [email protected] | www.arista.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-3456 has been fixed in the following releases: * 4.34.1F and later releases in the 4.34.x train * 4.33.4M and later releases in the 4.33.x train * 4.32.6M and later releases in the 4.32.x train * 4.31.8M and later releases in the 4.31.x train
Workarounds
CNA: There is no known mitigation for the issue. The recommended resolution is to upgrade to a remediated software version at your earliest convenience and afterwards rotate the custom global encryption-key.