CVE-2025-5089

Name of the Vulnerable Software and Affected Versions EOS (affected versions not specified) CVX server (affected versions not specified)

Description In a CVX cluster, a lack of resilience to malformed messages between an EOS switch and a connected CVX server can lead to a denial of service (DoS). Specifically, malformed messages sent from the CVX server to the EOS switch can cause the Sysdb agent to crash, resulting in a soft reset of the switch. Conversely, malformed messages sent from the EOS switch to the CVX server can cause agent crashes, leading to instability within the CVX cluster. Exploitation requires the attacker to have high privilege access to a connected device to send custom TCP packets. EOS switches not connected to a CVX server are not impacted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.