Arista DANZ Monitoring Fabric: restricted CLI user can break out to the system shell and escalate privileges

CVSS 7.8CVE-2025-54545Firmware, BMC & network fabriccurated

Impact

A user who was only meant to have a restricted DMF CLI account can leave the sandbox and reach the underlying system shell with elevated privileges. DMF controllers sit on the management network and hold the tap/filter policy for the packet-broker fabric, so shell on the controller means the operator's visibility layer can be reconfigured or silenced, and any credentials the controller holds for managed switches become reachable. On a GPU fleet this is a monitoring and east-west-visibility compromise rather than a tenant-data one, but it is a management-plane root foothold reached from an account that was deliberately scoped down.

Who can reach it

Local, authenticated: anyone holding a restricted DMF CLI account, typically reached over SSH from the management VLAN. No unauthenticated path is described.

What to do

Upgrade the DMF controller software to a fixed release per Arista security advisory 0124; the advisory is the authority on which versions carry the fix - the NVD record does not name one. Plan for a controller software upgrade and restart of the DMF management plane; tapped traffic forwarding is not the thing being patched. Until then, treat restricted DMF CLI accounts as equivalent to shell accounts and remove any that do not need to exist.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-54545 https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.