Arista EOS: the global common encryption key is written in clear text to accounting logs

CVSS 3.8CVE-2025-3456Firmware, BMC & network fabriccurated

Impact

The global common encryption key configured on an EOS switch can be recorded in clear text in local or remote accounting logs. Anyone who can read those logs, combined with the encrypted secrets visible in the device running-config, can recover the plaintext protocol passwords - and because neighbor protocols such as routing adjacencies require symmetric passwords across devices, one recovered key can cover a set of switches in the same fabric. For a datacenter leaf-spine or storage fabric that means an attacker with log access gains the credentials needed to form or spoof protocol relationships rather than just reading telemetry. Scored low (3.8) because it needs local authenticated access, but the scope is marked changed for exactly this reason: the exposure lands on neighbouring devices, not only the one that logged it.

Who can reach it

A local authenticated user on the switch, or anyone with read access to the remote accounting/syslog collector that receives EOS accounting records - a log aggregator is often far more widely readable than the switches themselves. No access to the data plane is needed.

What to do

Follow Arista security advisory 0122 for the fixed EOS releases and any hotfix offered; the advisory is the authoritative source for which trains are affected. Treat already-written logs as compromised: purge or restrict the accounting logs that captured the key, then rotate the common encryption key and every protocol secret derived from it across the devices that share it - that rotation, not the software update, is the expensive part, since it touches both sides of each neighbor relationship.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-3456 https://www.arista.com/en/support/advisories-notices/security-advisory/22022-security-advisory-0122

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.