CVE-2025-5088: Arista CloudVision Exchange (CVX) Cluster Privilege Escalation via MCS Redis Session

Published Jun 5, 2026

Updated

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

Affected Software

1 affected component

Arista CloudVision Exchange (CVX)

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-5088 has been fixed in the following releases: * 4.34.2F and later releases in the 4.34.x train * 4.33.5M and later releases in the 4.33.x train * 4.32.7M and later releases in the 4.32.x train * 4.31.9M and later releases in the 4.31.x train

Event History

Jun 5, 2026

CVE Published

via MITRE·03:58 PM

Data Sourced

via MITRE·03:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-5088?

The severity of CVE-2025-5088 is rated high with a CVSS score of 8.7.

How do I fix CVE-2025-5088?

To fix CVE-2025-5088, upgrade to a remediated version of Arista CloudVision Exchange (CVX) as soon as possible.

What kind of access does CVE-2025-5088 allow an attacker to gain?

CVE-2025-5088 allows an attacker to gain full root access to all servers in the CVX cluster.

What are the requirements for exploiting CVE-2025-5088?

Exploitation of CVE-2025-5088 requires network access to the Redis service on a CVX server and knowledge of the Redis password.

Is authentication required to exploit CVE-2025-5088?

Yes, an authenticated Redis session is required to exploit CVE-2025-5088.