CVE-2025-1259
Published: 04 March 2025
Summary
CVE-2025-1259 is a high-severity Improper Access Control (CWE-284) vulnerability in Arista EOS (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device Configuration Dump (T1602.002); ranked at the 49.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-1259 affects Arista EOS platforms with OpenConfig configured, where a gNOI request can be executed even when it should be rejected. This improper access control vulnerability, classified under CWE-284, enables users to retrieve data that is not intended to be available to them. The issue carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), highlighting high confidentiality impact with network accessibility and low attack complexity.
Exploitation requires low privileges (PR:L) over the network without user interaction. A malicious authenticated user can send a gNOI request that circumvents rejection logic, achieving scoped high-impact unauthorized data disclosure from the affected EOS instance.
Arista has issued a security advisory providing details on mitigations and patches at https://www.arista.com/en/support/advisories-notices/security-advisory/21098-security-advisory-0111. Security practitioners should consult this for specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7379
Vulnerability details
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control in gNOI allows low-priv authenticated users to bypass rejection logic and retrieve unauthorized data from the network device, directly enabling network device configuration/state data collection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access, addressing the core failure to reject unauthorized gNOI requests in Arista EOS OpenConfig.
Requires identification, reporting, and correction of flaws like the improper access control in gNOI request handling, enabling patching per Arista advisory.
Limits privileges to the minimum necessary, mitigating unauthorized data disclosure by low-privileged (PR:L) users exploiting the gNOI vulnerability.