CVE-2025-8873Arista EOS Dataplane Denial of Service via Malformed IPsec Packet
- 8.7HighCVSS base score
- 0.39%Exploitation in 30 daysEPSS · top 67% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the system. This issue was reported by an Arista customer.
Timeline
ID reserved
By Arista
- 10 months later
· 10 months later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| AristaCNA (assigner) | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| AristaCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Awaiting Analysis | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.39% · top 67% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Affected products
- affected 4.33.0M – ≤ 4.33.4M
- affected 4.32.0M – ≤ 4.32.6.1M
- affected 4.31.0M – ≤ 4.31.7.1M
- affected 4.30.0M – ≤ 4.30.10M
- affected 4.29.0M – ≤ 4.29.10.1M
What to do
Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see https://www.arista.com/en/support/toi/tcam-profile?pn=ipsec-egress-padding-removal . This may momentarily impact traffic. Apply the configuration found at the url to create a TCAM profile and then apply the TCAM profile as shown below. switch(config)#hardware tcam switch(config-tcam)#system profile ipsec-egress-padding-removal ! WARNING! Changing TCAM profile will cause forwarding agent(s) to exit and restart. All traffic through the forwarding chip managed by the restarting forwarding agent will be dropped. Proceed [y/n]y switch(config-tcam)# To ensure the TCAM profile has been applied, run the following command and verify the Configuration and Status values match ipsec-egress-padding-removal: switch(config-tcam)#show hardware tcam profile Configuration Status FixedSystem ipsec-egress-padding-removal ipsec-egress-padding-removal ‘ipsec-egress-padding-removal’ differs from the ‘ipsec’ TCAM profile in two ways: * Egress IP ACLs are disabled * Fixes for BUG603398 and BUG1246592 are applied
Workaround: There are no mitigations for this vulnerability.
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-210068 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-8873)Record last updated .