vulnerability
security-advisory-0111
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:M/C:C/I:C/A:C) | Feb 25, 2025 | Feb 27, 2025 | Jan 14, 2026 |
Severity
8
CVSS
(AV:N/AC:L/Au:M/C:C/I:C/A:C)
Published
Feb 25, 2025
Added
Feb 27, 2025
Modified
Jan 14, 2026
Description
For both CVE-2025-1259 and CVE-2025-1260, on affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. CVE-2025-1259 can result in users retrieving data that should not have been available. CVE-2025-1260 can result in unexpected configuration/operations being applied to the switch. These issues were discovered internally, and Arista is unaware of any malicious uses of these issues in customer networks. These are similar types of authorization issues and are being released together due to their similarity.
Solution
upgrade-solution-cve-2025-1260
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.