« Volver al listado

CVE-2025-54548

Estado: AplazadaMedia (4.3)—

On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-54548",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54548",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-30T14:13:10.416471Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@arista.com",
      "affectedData": [
        {
          "vendor": "Arista Networks",
          "product": "DANZ Monitoring Fabric",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "DMF 8.6.1"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "DMF 8.5.2"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "CCF 6.2.4"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "CVA 7.0"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "MCD 2.4.0"
            }
          ],
          "platforms": [
            "DCA-350E-CV",
            "DCA-300-CV",
            "DCA-250-CV",
            "DCA-200-CV",
            "Arista Converged Cloud Fabric",
            "Arista DANZ Monitoring Fabric",
            "Arista Multi-Cloud Director"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-10-29T23:16:19.100",
  "references": [
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124",
      "source": "psirt@arista.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@arista.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)"
    },
    {
      "lang": "es",
      "value": "En plataformas afectadas, usuarios restringidos podrían ver porciones sensibles de la base de datos de configuración a través de una API de depuración (p. ej., hashes de contraseñas de usuario)"
    }
  ],
  "lastModified": "2026-10-01T16:10:00.257",
  "sourceIdentifier": "psirt@arista.com"
}