CVE-2025-1260: On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.

Published Mar 4, 2025

Updated

On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.

Affected Software

1 affected component

Arista EOS

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-1259 is fixed in the following releases: * 4.33.2 and later releases in the 4.33.x train * 4.32.4 and later releases in the 4.32.x train * 4.31.6 and later releases in the 4.31.x train * 4.30.9 and later releases in the 4.30.x train * 4.29.10 and later releases in the 4.29.x train * 4.28.13 and later releases in the 4.28.x train

Event History

Mar 4, 2025

CVE Published

via MITRE·07:49 PM

Data Sourced

via MITRE·07:49 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-1260?

CVE-2025-1260 is classified as a high severity vulnerability that can lead to unexpected configuration changes on affected Arista EOS devices.

How do I fix CVE-2025-1260?

To resolve CVE-2025-1260, ensure that you upgrade to the latest version of Arista EOS that addresses this vulnerability.

What are the potential impacts of CVE-2025-1260?

The potential impacts of CVE-2025-1260 include unauthorized configuration changes and disruptions to network operations.

Which versions of Arista EOS are affected by CVE-2025-1260?

All versions of Arista EOS configured with OpenConfig are potentially affected by CVE-2025-1260.

Is there a workaround for CVE-2025-1260?

While the primary mitigation is an upgrade, users may also restrict gNOI requests as an interim workaround to mitigate risks from CVE-2025-1260.