CVE-2025-1259 (GCVE-0-2025-1259)

Vulnerability from cvelistv5 – Published: 2025-03-04 19:44 – Updated: 2025-03-04 20:12
VLAI?
Summary
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available
Severity ?
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Arista Networks EOS Affected: 4.33.0 , ≤ 4.33.1 (custom)
Affected: 4.32.0 , ≤ 4.32.3 (custom)
Affected: 4.31.0 , ≤ 4.31.5 (custom)
Affected: 4.30.0 , ≤ 4.30.8 (custom)
Affected: 4.29.0 , ≤ 4.29.9 (custom)
Affected: 4.28.0 , ≤ 4.28.12 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1259",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T20:12:13.556121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-04T20:12:25.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.33.1",
              "status": "affected",
              "version": "4.33.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.32.3",
              "status": "affected",
              "version": "4.32.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.31.5",
              "status": "affected",
              "version": "4.31.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.30.8",
              "status": "affected",
              "version": "4.30.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.29.9",
              "status": "affected",
              "version": "4.29.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.28.12",
              "status": "affected",
              "version": "4.28.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTo be vulnerable to CVE-2025-1259 and CVE-2025-1260 the only condition is that OpenConfig must be enabled with a gNOI server.\u003c/p\u003e\u003cpre\u003eswitch(config-gnmi-transport-default)#show management api gnmi\nTransport: default\nEnabled: \u003cspan style=\"background-color: rgb(255, 255, 0);\"\u003eyes\u003c/span\u003e\nServer: running on port 6030, in default VRF\nSSL profile: none\nQoS DSCP: none\nAuthorization required: no\nAccounting requests: no\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIf OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.\u003c/p\u003e\u003cpre\u003eswitch(config)#show management api gnmi \nEnabled: \u003cspan style=\"background-color: rgb(255, 255, 0);\"\u003eno transports enabled\u003c/span\u003e\u003c/pre\u003e"
            }
          ],
          "value": "To be vulnerable to CVE-2025-1259 and CVE-2025-1260 the only condition is that OpenConfig must be enabled with a gNOI server.\n\nswitch(config-gnmi-transport-default)#show management api gnmi\nTransport: default\nEnabled: yes\nServer: running on port 6030, in default VRF\nSSL profile: none\nQoS DSCP: none\nAuthorization required: no\nAccounting requests: no\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n\n\n\u00a0\n\nIf OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.\n\nswitch(config)#show management api gnmi \nEnabled: no transports enabled"
        }
      ],
      "datePublic": "2025-02-25T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecan result in users retrieving data that should not have been available\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue\u00a0can result in users retrieving data that should not have been available"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-04T19:44:34.221Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21098-security-advisory-0111"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e\u003c/p\u003e\u003cp\u003eCVE-2025-1259 is fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.2 and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.32.4 and later releases in the 4.32.x train\u003c/li\u003e\u003cli\u003e4.31.6 and later releases in the 4.31.x train\u003c/li\u003e\u003cli\u003e4.30.9 and later releases in the 4.30.x train\u003c/li\u003e\u003cli\u003e4.29.10 and later releases in the 4.29.x train\u003c/li\u003e\u003cli\u003e4.28.13 and later releases in the 4.28.x train\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see  EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \n\nCVE-2025-1259 is fixed in the following releases:\n\n  *  4.33.2 and later releases in the 4.33.x train\n  *  4.32.4 and later releases in the 4.32.x train\n  *  4.31.6 and later releases in the 4.31.x train\n  *  4.30.9 and later releases in the 4.30.x train\n  *  4.29.10 and later releases in the 4.29.x train\n  *  4.28.13 and later releases in the 4.28.x train"
        }
      ],
      "source": {
        "advisory": "SA 111",
        "defect": [
          "1015822"
        ],
        "discovery": "INTERNAL"
      },
      "title": "On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFor releases with gNSI Authz (EOS 4.31.0F and later releases), the gNOI RPC\u2019s can be blocked using gNSI Authz.\u003c/p\u003e\u003cp\u003eFirst enable gNSI Authz service by adding the following config:\u003c/p\u003e\u003cpre\u003eswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n(config-mgmt-api-gnsi)#transport gnmi [NAME]\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eWhere [NAME] is the name of the running gNMI transport which gNSI will run on. Adding this config will cause the named gNMI transport to reload.\u003c/p\u003e\u003cp\u003eNext update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes. Note this will replace any existing authz policies located at /persist/sys/gnsi/authz/policy.json\u003c/p\u003e\u003cp\u003eFor CVE-2025-1259 the following CLI command (highlighted in yellow following the switch prompt) can be run which will disable all gNOI Get RPC\u2019s.\u003c/p\u003e\u003cpre\u003eswitch#\u003cspan style=\"background-color: rgb(255, 255, 0);\"\u003ebash timeout 100 echo \"{\\\"name\\\":\\\"block gNOI GET RPC\u0027s policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"allow_all\\\"}],\\\"deny_rules\\\":[{\\\"name\\\":\\\"no-gnoi-get\\\",\\\"request\\\":{\\\"paths\\\":[\\\"/gnoi.packet_link_qualification.LinkQualification/List\\\",\\\"/gnoi.certificate.CertificateManagement/GetCertificates\\\",\\\"/gnoi.os.OS/Verify\\\",\\\"/gnoi.healthz.Healthz/Get\\\",\\\"/gnoi.healthz.Healthz/List\\\",\\\"/gnoi.system.System/RebootStatus\\\",\\\"/gnmi.gNMI/Subscribe\\\",\\\"/gnoi.file.File/Stat\\\",\\\"/gnoi.system.System/Traceroute\\\",\\\"/gnoi.packet_link_qualification.LinkQualification/Get\\\",\\\"/gnoi.system.System/Ping\\\",\\\"/gnoi.file.File/Get\\\",\\\"/gnsi.authz.v1.Authz/Probe\\\",\\\"/gnsi.credentialz.v1.Credentialz/GetPublicKeys\\\",\\\"/gnsi.pathz.v1.Pathz/Probe\\\",\\\"/gnoi.healthz.Healthz/Acknowledge\\\",\\\"/gnsi.certz.v1.Certz/CanGenerateCSR\\\",\\\"/gnmi.gNMI/Get\\\",\\\"/gnoi.certificate.CertificateManagement/CanGenerateCSR\\\",\\\"/gnoi.healthz.Healthz/Artifact\\\",\\\"/gnsi.authz.v1.Authz/Get\\\",\\\"/gnoi.system.System/Time\\\",\\\"/gnsi.pathz.v1.Pathz/Get\\\",\\\"/gnoi.packet_link_qualification.LinkQualification/Capabilities\\\",\\\"/gnsi.acctz.v1.AcctzStream/RecordSubscribe\\\",\\\"/gnsi.credentialz.v1.Credentialz/CanGenerateKey\\\",\\\"/gnoi.healthz.Healthz/Check\\\",\\\"/gnsi.certz.v1.Certz/GetProfileList\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json \u0026amp;\u0026amp; sleep 11\u003c/span\u003e\u0026nbsp;\u003c/pre\u003e"
            }
          ],
          "value": "For releases with gNSI Authz (EOS 4.31.0F and later releases), the gNOI RPC\u2019s can be blocked using gNSI Authz.\n\nFirst enable gNSI Authz service by adding the following config:\n\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n(config-mgmt-api-gnsi)#transport gnmi [NAME]\n\n\n\u00a0\n\nWhere [NAME] is the name of the running gNMI transport which gNSI will run on. Adding this config will cause the named gNMI transport to reload.\n\nNext update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes. Note this will replace any existing authz policies located at /persist/sys/gnsi/authz/policy.json\n\nFor CVE-2025-1259 the following CLI command (highlighted in yellow following the switch prompt) can be run which will disable all gNOI Get RPC\u2019s.\n\nswitch#bash timeout 100 echo \"{\\\"name\\\":\\\"block gNOI GET RPC\u0027s policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"allow_all\\\"}],\\\"deny_rules\\\":[{\\\"name\\\":\\\"no-gnoi-get\\\",\\\"request\\\":{\\\"paths\\\":[\\\"/gnoi.packet_link_qualification.LinkQualification/List\\\",\\\"/gnoi.certificate.CertificateManagement/GetCertificates\\\",\\\"/gnoi.os.OS/Verify\\\",\\\"/gnoi.healthz.Healthz/Get\\\",\\\"/gnoi.healthz.Healthz/List\\\",\\\"/gnoi.system.System/RebootStatus\\\",\\\"/gnmi.gNMI/Subscribe\\\",\\\"/gnoi.file.File/Stat\\\",\\\"/gnoi.system.System/Traceroute\\\",\\\"/gnoi.packet_link_qualification.LinkQualification/Get\\\",\\\"/gnoi.system.System/Ping\\\",\\\"/gnoi.file.File/Get\\\",\\\"/gnsi.authz.v1.Authz/Probe\\\",\\\"/gnsi.credentialz.v1.Credentialz/GetPublicKeys\\\",\\\"/gnsi.pathz.v1.Pathz/Probe\\\",\\\"/gnoi.healthz.Healthz/Acknowledge\\\",\\\"/gnsi.certz.v1.Certz/CanGenerateCSR\\\",\\\"/gnmi.gNMI/Get\\\",\\\"/gnoi.certificate.CertificateManagement/CanGenerateCSR\\\",\\\"/gnoi.healthz.Healthz/Artifact\\\",\\\"/gnsi.authz.v1.Authz/Get\\\",\\\"/gnoi.system.System/Time\\\",\\\"/gnsi.pathz.v1.Pathz/Get\\\",\\\"/gnoi.packet_link_qualification.LinkQualification/Capabilities\\\",\\\"/gnsi.acctz.v1.AcctzStream/RecordSubscribe\\\",\\\"/gnsi.credentialz.v1.Credentialz/CanGenerateKey\\\",\\\"/gnoi.healthz.Healthz/Check\\\",\\\"/gnsi.certz.v1.Certz/GetProfileList\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json \u0026\u0026 sleep 11"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2025-1259",
    "datePublished": "2025-03-04T19:44:34.221Z",
    "dateReserved": "2025-02-12T18:10:26.386Z",
    "dateUpdated": "2025-03-04T20:12:25.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-1259\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2025-03-04T20:15:37.003\",\"lastModified\":\"2025-03-04T20:15:37.003\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue\u00a0can result in users retrieving data that should not have been available\"},{\"lang\":\"es\",\"value\":\"En las plataformas afectadas que ejecutan Arista EOS con OpenConfig configurado, se puede ejecutar una solicitud gNOI cuando deber\u00eda haber sido rechazada. Este problema puede provocar que los usuarios recuperen datos que no deber\u00edan haber estado disponibles\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/21098-security-advisory-0111\",\"source\":\"psirt@arista.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-1259\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-04T20:12:13.556121Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-04T20:12:17.163Z\"}}], \"cna\": {\"title\": \"On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected.\", \"source\": {\"defect\": [\"1015822\"], \"advisory\": \"SA 111\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.33.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.33.1\"}, {\"status\": \"affected\", \"version\": \"4.32.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.32.3\"}, {\"status\": \"affected\", \"version\": \"4.31.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.31.5\"}, {\"status\": \"affected\", \"version\": \"4.30.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.30.8\"}, {\"status\": \"affected\", \"version\": \"4.29.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.29.9\"}, {\"status\": \"affected\", \"version\": \"4.28.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.28.12\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see  EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades \\n\\nCVE-2025-1259 is fixed in the following releases:\\n\\n  *  4.33.2 and later releases in the 4.33.x train\\n  *  4.32.4 and later releases in the 4.32.x train\\n  *  4.31.6 and later releases in the 4.31.x train\\n  *  4.30.9 and later releases in the 4.30.x train\\n  *  4.29.10 and later releases in the 4.29.x train\\n  *  4.28.13 and later releases in the 4.28.x train\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades\\\"\u003eEOS User Manual: Upgrades and Downgrades\u003c/a\u003e\u003c/p\u003e\u003cp\u003eCVE-2025-1259 is fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.2 and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.32.4 and later releases in the 4.32.x train\u003c/li\u003e\u003cli\u003e4.31.6 and later releases in the 4.31.x train\u003c/li\u003e\u003cli\u003e4.30.9 and later releases in the 4.30.x train\u003c/li\u003e\u003cli\u003e4.29.10 and later releases in the 4.29.x train\u003c/li\u003e\u003cli\u003e4.28.13 and later releases in the 4.28.x train\u003c/li\u003e\u003c/ul\u003e\", \"base64\": false}]}], \"datePublic\": \"2025-02-25T16:00:00.000Z\", \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/21098-security-advisory-0111\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"For releases with gNSI Authz (EOS 4.31.0F and later releases), the gNOI RPC\\u2019s can be blocked using gNSI Authz.\\n\\nFirst enable gNSI Authz service by adding the following config:\\n\\nswitch(config)#management api gnsi\\nswitch(config-mgmt-api-gnsi)#service authz\\n(config-mgmt-api-gnsi)#transport gnmi [NAME]\\n\\n\\n\\u00a0\\n\\nWhere [NAME] is the name of the running gNMI transport which gNSI will run on. Adding this config will cause the named gNMI transport to reload.\\n\\nNext update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes. Note this will replace any existing authz policies located at /persist/sys/gnsi/authz/policy.json\\n\\nFor CVE-2025-1259 the following CLI command (highlighted in yellow following the switch prompt) can be run which will disable all gNOI Get RPC\\u2019s.\\n\\nswitch#bash timeout 100 echo \\\"{\\\\\\\"name\\\\\\\":\\\\\\\"block gNOI GET RPC\u0027s policy\\\\\\\",\\\\\\\"allow_rules\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"allow_all\\\\\\\"}],\\\\\\\"deny_rules\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"no-gnoi-get\\\\\\\",\\\\\\\"request\\\\\\\":{\\\\\\\"paths\\\\\\\":[\\\\\\\"/gnoi.packet_link_qualification.LinkQualification/List\\\\\\\",\\\\\\\"/gnoi.certificate.CertificateManagement/GetCertificates\\\\\\\",\\\\\\\"/gnoi.os.OS/Verify\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Get\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/List\\\\\\\",\\\\\\\"/gnoi.system.System/RebootStatus\\\\\\\",\\\\\\\"/gnmi.gNMI/Subscribe\\\\\\\",\\\\\\\"/gnoi.file.File/Stat\\\\\\\",\\\\\\\"/gnoi.system.System/Traceroute\\\\\\\",\\\\\\\"/gnoi.packet_link_qualification.LinkQualification/Get\\\\\\\",\\\\\\\"/gnoi.system.System/Ping\\\\\\\",\\\\\\\"/gnoi.file.File/Get\\\\\\\",\\\\\\\"/gnsi.authz.v1.Authz/Probe\\\\\\\",\\\\\\\"/gnsi.credentialz.v1.Credentialz/GetPublicKeys\\\\\\\",\\\\\\\"/gnsi.pathz.v1.Pathz/Probe\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Acknowledge\\\\\\\",\\\\\\\"/gnsi.certz.v1.Certz/CanGenerateCSR\\\\\\\",\\\\\\\"/gnmi.gNMI/Get\\\\\\\",\\\\\\\"/gnoi.certificate.CertificateManagement/CanGenerateCSR\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Artifact\\\\\\\",\\\\\\\"/gnsi.authz.v1.Authz/Get\\\\\\\",\\\\\\\"/gnoi.system.System/Time\\\\\\\",\\\\\\\"/gnsi.pathz.v1.Pathz/Get\\\\\\\",\\\\\\\"/gnoi.packet_link_qualification.LinkQualification/Capabilities\\\\\\\",\\\\\\\"/gnsi.acctz.v1.AcctzStream/RecordSubscribe\\\\\\\",\\\\\\\"/gnsi.credentialz.v1.Credentialz/CanGenerateKey\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Check\\\\\\\",\\\\\\\"/gnsi.certz.v1.Certz/GetProfileList\\\\\\\"]}}]}\\\" | sudo tee /persist/sys/gnsi/authz/policy.json \u0026\u0026 sleep 11\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eFor releases with gNSI Authz (EOS 4.31.0F and later releases), the gNOI RPC\\u2019s can be blocked using gNSI Authz.\u003c/p\u003e\u003cp\u003eFirst enable gNSI Authz service by adding the following config:\u003c/p\u003e\u003cpre\u003eswitch(config)#management api gnsi\\nswitch(config-mgmt-api-gnsi)#service authz\\n(config-mgmt-api-gnsi)#transport gnmi [NAME]\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eWhere [NAME] is the name of the running gNMI transport which gNSI will run on. Adding this config will cause the named gNMI transport to reload.\u003c/p\u003e\u003cp\u003eNext update the authz policy to block access to the TransferToRemote RPC. This can be done directly on the system by updating the Authz policy file and waiting at least 10 seconds for OpenConfig to reload the changes. Note this will replace any existing authz policies located at /persist/sys/gnsi/authz/policy.json\u003c/p\u003e\u003cp\u003eFor CVE-2025-1259 the following CLI command (highlighted in yellow following the switch prompt) can be run which will disable all gNOI Get RPC\\u2019s.\u003c/p\u003e\u003cpre\u003eswitch#\u003cspan style=\\\"background-color: rgb(255, 255, 0);\\\"\u003ebash timeout 100 echo \\\"{\\\\\\\"name\\\\\\\":\\\\\\\"block gNOI GET RPC\u0027s policy\\\\\\\",\\\\\\\"allow_rules\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"allow_all\\\\\\\"}],\\\\\\\"deny_rules\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"no-gnoi-get\\\\\\\",\\\\\\\"request\\\\\\\":{\\\\\\\"paths\\\\\\\":[\\\\\\\"/gnoi.packet_link_qualification.LinkQualification/List\\\\\\\",\\\\\\\"/gnoi.certificate.CertificateManagement/GetCertificates\\\\\\\",\\\\\\\"/gnoi.os.OS/Verify\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Get\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/List\\\\\\\",\\\\\\\"/gnoi.system.System/RebootStatus\\\\\\\",\\\\\\\"/gnmi.gNMI/Subscribe\\\\\\\",\\\\\\\"/gnoi.file.File/Stat\\\\\\\",\\\\\\\"/gnoi.system.System/Traceroute\\\\\\\",\\\\\\\"/gnoi.packet_link_qualification.LinkQualification/Get\\\\\\\",\\\\\\\"/gnoi.system.System/Ping\\\\\\\",\\\\\\\"/gnoi.file.File/Get\\\\\\\",\\\\\\\"/gnsi.authz.v1.Authz/Probe\\\\\\\",\\\\\\\"/gnsi.credentialz.v1.Credentialz/GetPublicKeys\\\\\\\",\\\\\\\"/gnsi.pathz.v1.Pathz/Probe\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Acknowledge\\\\\\\",\\\\\\\"/gnsi.certz.v1.Certz/CanGenerateCSR\\\\\\\",\\\\\\\"/gnmi.gNMI/Get\\\\\\\",\\\\\\\"/gnoi.certificate.CertificateManagement/CanGenerateCSR\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Artifact\\\\\\\",\\\\\\\"/gnsi.authz.v1.Authz/Get\\\\\\\",\\\\\\\"/gnoi.system.System/Time\\\\\\\",\\\\\\\"/gnsi.pathz.v1.Pathz/Get\\\\\\\",\\\\\\\"/gnoi.packet_link_qualification.LinkQualification/Capabilities\\\\\\\",\\\\\\\"/gnsi.acctz.v1.AcctzStream/RecordSubscribe\\\\\\\",\\\\\\\"/gnsi.credentialz.v1.Credentialz/CanGenerateKey\\\\\\\",\\\\\\\"/gnoi.healthz.Healthz/Check\\\\\\\",\\\\\\\"/gnsi.certz.v1.Certz/GetProfileList\\\\\\\"]}}]}\\\" | sudo tee /persist/sys/gnsi/authz/policy.json \u0026amp;\u0026amp; sleep 11\u003c/span\u003e\u0026nbsp;\u003c/pre\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue\\u00a0can result in users retrieving data that should not have been available\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ecan result in users retrieving data that should not have been available\u003c/span\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"To be vulnerable to CVE-2025-1259 and CVE-2025-1260 the only condition is that OpenConfig must be enabled with a gNOI server.\\n\\nswitch(config-gnmi-transport-default)#show management api gnmi\\nTransport: default\\nEnabled: yes\\nServer: running on port 6030, in default VRF\\nSSL profile: none\\nQoS DSCP: none\\nAuthorization required: no\\nAccounting requests: no\\nNotification timestamp: last change time\\nListen addresses: ::\\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\\n\\n\\n\\u00a0\\n\\nIf OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.\\n\\nswitch(config)#show management api gnmi \\nEnabled: no transports enabled\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eTo be vulnerable to CVE-2025-1259 and CVE-2025-1260 the only condition is that OpenConfig must be enabled with a gNOI server.\u003c/p\u003e\u003cpre\u003eswitch(config-gnmi-transport-default)#show management api gnmi\\nTransport: default\\nEnabled: \u003cspan style=\\\"background-color: rgb(255, 255, 0);\\\"\u003eyes\u003c/span\u003e\\nServer: running on port 6030, in default VRF\\nSSL profile: none\\nQoS DSCP: none\\nAuthorization required: no\\nAccounting requests: no\\nNotification timestamp: last change time\\nListen addresses: ::\\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIf OpenConfig is not configured or OpenConfig is configured with no gNOI server, then there is no exposure to this issue and the message will look like.\u003c/p\u003e\u003cpre\u003eswitch(config)#show management api gnmi \\nEnabled: \u003cspan style=\\\"background-color: rgb(255, 255, 0);\\\"\u003eno transports enabled\u003c/span\u003e\u003c/pre\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2025-03-04T19:44:34.221Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-1259\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-04T20:12:25.230Z\", \"dateReserved\": \"2025-02-12T18:10:26.386Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2025-03-04T19:44:34.221Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.