2 lines
4.1 KiB
JSON
2 lines
4.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["CloudVision eXchange","virtual or physical appliance"],"product":"EOS / CloudVision eXchange (CVX)","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.34.1F","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.4M","status":"affected","version":"4.33.0M","versionType":"custom"},{"lessThanOrEqual":"4.32.6M","status":"affected","version":"4.32.0M","versionType":"custom"},{"lessThanOrEqual":"4.31.8M","status":"affected","version":"4.31.0M","versionType":"custom"},{"lessThan":"4.31.0","status":"affected","version":"4.30.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850."},{"lang":"es","value":"Una sesión Redis autenticada podría utilizarse para obtener acceso root completo a todos los servidores en el clúster CVX. Tenga en cuenta que esto requeriría que un atacante tuviera tanto acceso de red al servicio Redis en un servidor CVX como la contraseña de Redis. Tenga en cuenta que toda la comunicación Redis, incluida la autenticación, ocurre en texto plano actualmente. El soporte TLS se sigue bajo RFE1294850."}],"id":"CVE-2025-5088","lastModified":"2026-10-07T08:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-5088","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-09T14:09:38.315441Z","version":"2.0.3"}}]},"published":"2026-06-05T17:16:29.097","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@arista.com","type":"Secondary"}]}
|