A malformed message exchange between an EOS switch and a CVX server in a CVX cluster can cause the Sysdb agent on the EOS device or the server itself to crash, resulting in a soft reset of the switch or instability of the CVX cluster. The flaw is a classic input validation failure (CWE‑20) that allows an attacker to craft invalid TCP packets to trigger the crash. The impact is a loss of availability for the affected network element and potentially for the entire CVX ecosystem if the server crashes.

The critical components are Arista Networks EOS switches and the CloudVision eXchange (CVX) server. Versions prior to 4.34.2F in the 4.34 train, 4.33.5M in the 4.33 train, 4.32.7M in the 4.32 train, and 4.31.9M in the 4.31 train are vulnerable.

The CVSS score of 7.1 indicates a high severity risk, but EPSS is not available, suggesting that the exploitation probability is currently unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker would need high‑privilege access to the affected device or the ability to send custom TCP packets on the CVX control channel, indicating that the threat is most relevant to internal attackers or compromised administrators rather than external threat actors.