CVE-2025-1260: On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.
First published: Tue Mar 04 2025(Updated: )
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.
Credit: psirt@arista.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arista EOS |
Remedy
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-1259 is fixed in the following releases: * 4.33.2 and later releases in the 4.33.x train * 4.32.4 and later releases in the 4.32.x train * 4.31.6 and later releases in the 4.31.x train * 4.30.9 and later releases in the 4.30.x train * 4.29.10 and later releases in the 4.29.x train * 4.28.13 and later releases in the 4.28.x train
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1260?
CVE-2025-1260 is classified as a high severity vulnerability that can lead to unexpected configuration changes on affected Arista EOS devices.
How do I fix CVE-2025-1260?
To resolve CVE-2025-1260, ensure that you upgrade to the latest version of Arista EOS that addresses this vulnerability.
What are the potential impacts of CVE-2025-1260?
The potential impacts of CVE-2025-1260 include unauthorized configuration changes and disruptions to network operations.
Which versions of Arista EOS are affected by CVE-2025-1260?
All versions of Arista EOS configured with OpenConfig are potentially affected by CVE-2025-1260.
Is there a workaround for CVE-2025-1260?
While the primary mitigation is an upgrade, users may also restrict gNOI requests as an interim workaround to mitigate risks from CVE-2025-1260.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/description
- agent/remedy
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/arista
- canonical/arista eos