What’s Vulnerable › Vulnerabilities
CVE-2025-0505: On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state
- Severity: critical (CVSS 10.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-08 · updated 2026-06-17
- Weakness: CWE-269
Description
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.
Affected products
- Arista Networks CloudVision Portal: from 2024.2.0 through 2024.2.1; 2024.3.0
References
Get alerted when CVE-2025-0505 or the next vulnerability affects your stack