CVE-2025-0936

MEDIUM

Arista EOS 4.30.1F-4.30.8M, 4.31.0-4.31.4M, 4.32.0-4.32.2M, 4.33.0 - Plaintext Password Exposure

Title source: llm

Description

On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc).

References (1)

Core 1

Core References

Various Sources

https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117

Scores

CVSS v3 6.5

EPSS 0.0023

EPSS Percentile 13.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-256

Status published

Products (4)

Arista Networks/EOS 4.30.1F - 4.30.9M

Arista Networks/EOS 4.31.0 - 4.31.5M

Arista Networks/EOS 4.32.0 - 4.32.3M

Arista Networks/EOS 4.33.0 - 4.33.1

Published May 07, 2025

Tracked Since Feb 18, 2026