CVX is not resilient to unexpected messages from a connected switch, which can cause agent crashes and destabilize the CVX cluster. The flaw is a classic input validation weakness (CWE-20). An attacker who gains high‑privilege access on a connected switch could send specially crafted TCP packets to trigger a crash, effectively creating a denial‑of‑service scenario.

Arista Networks EOS and CloudVision eXchange (CVX) are affected. The vulnerability exists in all releases before 4.34.2F, 4.33.5M, and 4.32.7M for the 4.34, 4.33, and 4.32 trains respectively.

The CVSS score of 7.1 indicates a medium‑to‑high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, so exploitation likelihood is unknown. Based on the description, the attacker would need high‑privilege access to a switch to send custom packets, suggesting a high‑privilege attack vector requiring prior compromise of the switch environment.