CVE-2025-54549
BaseFortify
Publication date: 2025-10-29
Last updated on: 2025-10-30
Assigner: Arista Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arista | converged_cloud_fabric | * |
| arista | multi-cloud_director | * |
| arista | danz_monitoring_fabric | * |
| arista | cloudvision_appliance | 7.0.x |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the cryptographic validation process of upgrade images being bypassed by inserting a specially crafted file into the upgrade ISO. This means that the security check meant to verify the integrity and authenticity of upgrade files can be circumvented, potentially allowing unauthorized or malicious code to be introduced during an upgrade.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker with limited privileges to introduce malicious modifications into the upgrade process without detection. This can lead to unauthorized changes that compromise the integrity of the system, potentially resulting in elevated privileges or disruption of services.