Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-54547

Summary
Assigner-Arista
Assigner Org ID-c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7
Published At-29 Oct, 2025 | 22:45
Updated At-30 Oct, 2025 | 14:15
Rejected At-
Credits

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Arista
Assigner Org ID:c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7
Published At:29 Oct, 2025 | 22:45
Updated At:30 Oct, 2025 | 14:15
Rejected At:
▼CVE Numbering Authority (CNA)
On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

Affected Products
Vendor
Arista Networks, Inc.Arista Networks
Product
DANZ Monitoring Fabric
Platforms
  • DCA-350E-CV
  • DCA-300-CV
  • DCA-250-CV
  • DCA-200-CV
  • Arista Converged Cloud Fabric
  • Arista DANZ Monitoring Fabric
  • Arista Multi-Cloud Director
Default Status
unaffected
Versions
Affected
  • 0 (custom)
  • From 0 through DMF 8.6.1 (custom)
  • From 0 through DMF 8.5.2 (custom)
  • From 0 through CCF 6.2.4 (custom)
  • From 0 through CVA 7.0 (custom)
  • From 0 through MCD 2.4.0 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-613CWE-613
Type: CWE
CWE ID: CWE-613
Description: CWE-613
Metrics
VersionBase scoreBase severityVector
3.15.3MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-60CAPEC-60 Reusing Session IDs (aka Session Replay)
CAPEC ID: CAPEC-60
Description: CAPEC-60 Reusing Session IDs (aka Session Replay)
Solutions

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. Fixed versions are as follows for each product:   Danz Monitoring Fabric * DMF 8.7.1 and later releases in the 8.7.x train * DMF 8.6.2 and later releases in the 8.6.x train * DMF 8.5.3 and later releases in the 8.5.x train * DMF 8.4.6 and later releases in the 8.4.x train.   Converged Cloud Fabric * CCF 6.2.5 and later releases in the 6.2.x train   Cloud Vision Appliance * CVA 7.1.0 and later releases in the CVA 7.x train   Multi-Cloud Director * MCD 2.4.1 and later releases in the 2.4.x train

Configurations

The following conditions must be met: The connecting SSH client must be configured to allow multiple sessions to be multiplexed onto the same SSH Connection (e.g., via the OpenSSH ControlMaster auto configuration or other equivalent configurations); The ControlMaster connection must be active; The attacker must have access to the ControlMaster socket on the client.

Workarounds

No known mitigation

Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
N/A
Hyperlink: https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-613CWE-613 Insufficient Session Expiration
Type: CWE
CWE ID: CWE-613
Description: CWE-613 Insufficient Session Expiration
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:psirt@arista.com
Published At:29 Oct, 2025 | 23:16
Updated At:30 Oct, 2025 | 15:15

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.15.3MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Type: Secondary
Version: 3.1
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-613Secondarypsirt@arista.com
CWE-613Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-613
Type: Secondary
Source: psirt@arista.com
CWE ID: CWE-613
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124psirt@arista.com
N/A
Hyperlink: https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
Source: psirt@arista.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found