vulnerability
security-advisory-0111
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:M/C:C/I:C/A:C) | Feb 25, 2025 | Feb 27, 2025 | Apr 29, 2025 |
Severity
8
CVSS
(AV:N/AC:L/Au:M/C:C/I:C/A:C)
Published
Feb 25, 2025
Added
Feb 27, 2025
Modified
Apr 29, 2025
Description
For both CVE-2025-1259 and CVE-2025-1260, on affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. CVE-2025-1259 can result in users retrieving data that should not have been available. CVE-2025-1260 can result in unexpected configuration/operations being applied to the switch. These issues were discovered internally, and Arista is unaware of any malicious uses of these issues in customer networks. These are similar types of authorization issues and are being released together due to their similarity.
Solution
upgrade-solution-CVE-2025-1260
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.