QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-3456

Back to search

CVE-2025-3456

Published: Aug 25, 2025

Modified: Aug 25, 2025

PUBLISHED

CVSS v3.1

3.8

LOW

Description

On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.

VendorProductVersions

Arista Networks

EOS

affected
4.34.0F
affected
4.33.0 - <= 4.33.3F
affected
4.32.0 - <= 4.32.5M
affected
4.31.0 - <= 4.31.7M
affected
4.30.0 - <= 4.30.10M

+1 more versions

Weaknesses (CWE)

CWE-532

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now