CVE-2025-0936: On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly

Published May 7, 2025

Updated

On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc).

Affected Software

1 affected component

Arista EOS

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-0936 has been fixed in the following releases: * 4.30.10M and later releases in the 4.30.x train * 4.31.7M and later releases in the 4.31.x train * 4.32.5M and later releases in the 4.32.x train * 4.33.2F and later releases

Event History

May 7, 2025

CVE Published

via MITRE·10:52 PM

Data Sourced

via MITRE·10:52 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-0936?

CVE-2025-0936 is classified as a moderate severity vulnerability affecting Arista EOS.

How do I fix CVE-2025-0936?

To fix CVE-2025-0936, update your Arista EOS to the latest version that addresses this vulnerability.

What are the potential risks associated with CVE-2025-0936?

The risks associated with CVE-2025-0936 include unintentional logging of remote server credentials which could lead to unauthorized access.

Which systems are affected by CVE-2025-0936?

CVE-2025-0936 affects platforms running Arista EOS with gNMI transport enabled.

Can CVE-2025-0936 lead to data exposure?

Yes, CVE-2025-0936 can potentially lead to the exposure of sensitive credentials if not mitigated.