« Volver al listado

CVE-2025-54549

Estado: AplazadaMedia (5.9)—

Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-54549",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54549",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-30T14:12:50.353170Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@arista.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@arista.com",
      "affectedData": [
        {
          "vendor": "Arista Networks",
          "product": "DANZ Monitoring Fabric",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "DMF 8.6.1"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "DMF 8.5.2"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "CCF 6.2.4"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "CVA 7.0"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "MCD 2.4.0"
            }
          ],
          "platforms": [
            "DCA-350E-CV",
            "DCA-300-CV",
            "DCA-250-CV",
            "DCA-200-CV",
            "Arista Converged Cloud Fabric",
            "Arista DANZ Monitoring Fabric",
            "Arista Multi-Cloud Director"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-10-29T23:16:19.227",
  "references": [
    {
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124",
      "source": "psirt@arista.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@arista.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO"
    },
    {
      "lang": "es",
      "value": "La validación criptográfica de las imágenes de actualización podría eludirse al colocar un archivo específicamente diseñado en la ISO de actualización."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "sourceIdentifier": "psirt@arista.com"
}