Arista DANZ Monitoring Fabric: restricted users can SSH-port-forward into host-internal services

CVSS 7.5CVE-2025-54546Firmware, BMC & network fabriccurated

Impact

Restricted DMF users can set up SSH port forwarding and reach services that the controller only ever intended to expose on localhost - internal APIs, databases and management endpoints that carry no authentication of their own because they were assumed unreachable. The attacker turns a scoped-down CLI account into a tunnel endpoint on the management network. This is a distinct issue from the CLI sandbox escape in the same advisory: here no shell is obtained, but the controller's internal service surface becomes addressable from wherever the user can SSH in.

Who can reach it

Network, authenticated with low privilege: a restricted DMF user with SSH access to the controller, reachable from the management VLAN. Arista rates attack complexity high.

What to do

Upgrade the DMF controller to a fixed release per Arista security advisory 0124; the NVD record does not state a fixed version, so take it from the advisory. Involves a controller software upgrade and management-plane restart. As an interim control, restrict which hosts may SSH to the DMF controller and audit restricted accounts, since the loopback-only assumption protecting the internal services no longer holds.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-54546 https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.