# CVE-2025-5089: Arista EOS and CVX denial of service via malformed messages

Source: https://junglewise.ai/threats/cve-2025-5089-arista-eos-and-cvx-denial-of-service-via-malformed-messages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-5089 · Severity: medium · CVSS 6.5 · Published 2026-06-05

Arista EOS switches and CVX servers are vulnerable to a denial-of-service condition when communicating within a CVX cluster. An attacker with high-privilege access to a connected device can send specially crafted messages that cause the switch to reset or the management cluster to become unstable. This can lead to temporary network disruptions and loss of management capabilities for the affected infrastructure.

Technologies: [Arista Networks CloudVision eXchange](https://junglewise.ai/threats/technologies/cloudvision-exchange). Vendors: [Arista Networks](https://junglewise.ai/threats/vendors/arista-networks).

## Quick answers

**Is CVE-2025-5089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5089 being exploited in the wild.

**How severe is CVE-2025-5089?** Medium severity, with a CVSS score of 6.5, published 5 June 2026.

**Which products and versions are affected?** Arista Networks EOS; Arista Networks CloudVision eXchange (CVX).

**Is there a fix for CVE-2025-5089?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-5089 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-5089?** Check whether you run Arista Networks CloudVision eXchange. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as improper input validation (CWE-20) within the communication protocol between Arista EOS switches and CVX servers. When a malformed message is received, it can trigger a Sysdb agent crash on the EOS device, resulting in a soft reset, or cause agent crashes on the CVX server, leading to cluster instability. Exploitation requires the attacker to have high-privileged access to a device already participating in the CVX cluster to inject custom TCP packets. Only EOS switches actively connected to a CVX server are impacted; standalone switches are not vulnerable.

## Affected products

- Arista Networks EOS
- Arista Networks CloudVision eXchange (CVX)

## Timeline

- 2026-06-05: disclosed
- 2026-06-05: advisory

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126](https://www.arista.com/en/support/advisories-notices/security-advisory/22868-security-advisory-0126)

## Related threats

- [Arista CVX denial of service via improper input validation](https://junglewise.ai/threats/cve-2025-5090-arista-cvx-denial-of-service-via-improper-input-validation)