On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the system. This issue was reported by an Arista customer.
"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/22869-security-advisory-0127","tags":["vendor-advisory"]}],"configurations":[{"lang":"en","value":"In order to be vulnerable to CVE-2025-8873, the following condition must be met: IPsec must be configured:\n\n\n\n\nswitch>show ip security connection\nLegend: (P) policy based VPN tunnel\nTunnel Source Dest Status Uptime Input Output Rekey Time\nTunnel8 10.0.0.1 10.0.0.2 Established 1 minute 0 bytes 0 bytes 54 minutes 30 pkts 30 pkts.\n\n\n\n\nIf IPsec is not configured there is no exposure to this issue and the message will look like:\n\n\n\n\nswitch>show ip security connection\nLegend: (P) policy based VPN tunnel.","supportingMedia":[{"type":"text/html","base64":false,"value":"In order to be vulnerable to CVE-2025-8873, the following condition must be met: IPsec must be configured:
\nswitch>show ip security connection\nLegend: (P) policy based VPN tunnel\nTunnel Source Dest Status Uptime Input Output Rekey Time\nTunnel8 10.0.0.1 10.0.0.2 Established 1 minute 0 bytes 0 bytes 54 minutes 30 pkts 30 pkts.If IPsec is not configured there is no exposure to this issue and the message will look like:
\nswitch>show ip security connection\nLegend: (P) policy based VPN tunnel.There are no mitigations for this vulnerability.
"}]}],"solutions":[{"lang":"en","value":"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see https://www.arista.com/en/support/toi/tcam-profile?pn=ipsec-egress-padding-removal .\n\n\n\nThis may momentarily impact traffic. Apply the configuration found at the url to create a TCAM profile and then apply the TCAM profile as shown below.\n\n\n\nswitch(config)#hardware tcam\nswitch(config-tcam)#system profile ipsec-egress-padding-removal\n!\nWARNING!\nChanging TCAM profile will cause forwarding agent(s) to exit and restart.\nAll traffic through the forwarding chip managed by the restarting\nforwarding agent will be dropped.\n \nProceed [y/n]y\nswitch(config-tcam)#\n\n\n \n\n\n\nTo ensure the TCAM profile has been applied, run the following command and verify the Configuration and Status values match ipsec-egress-padding-removal:\n\n\n\nswitch(config-tcam)#show hardware tcam profile\n Configuration Status\nFixedSystem ipsec-egress-padding-removal \nipsec-egress-padding-removal\n\n\n \n\n\n\n‘ipsec-egress-padding-removal’ differs from the ‘ipsec’ TCAM profile in two ways:\n\n * Egress IP ACLs are disabled\n * Fixes for BUG603398 and BUG1246592 are applied","supportingMedia":[{"type":"text/html","base64":false,"value":"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades
After upgrading to a remediated version of software, the system TCAM profile must be changed to ipsec-egress-padding-removal: https://www.arista.com/en/support/toi/tcam-profile?pn=ipsec-egress-padding-removal.
This may momentarily impact traffic. Apply the configuration found at the url to create a TCAM profile and then apply the TCAM profile as shown below.
switch(config)#hardware tcam\nswitch(config-tcam)#system profile ipsec-egress-padding-removal\n!\nWARNING!\nChanging TCAM profile will cause forwarding agent(s) to exit and restart.\nAll traffic through the forwarding chip managed by the restarting\nforwarding agent will be dropped.\n \nProceed [y/n]y\nswitch(config-tcam)#\n
To ensure the TCAM profile has been applied, run the following command and verify the Configuration and Status values match ipsec-egress-padding-removal:
switch(config-tcam)#show hardware tcam profile\n Configuration Status\nFixedSystem ipsec-egress-padding-removal \nipsec-egress-padding-removal\n
‘ipsec-egress-padding-removal’ differs from the ‘ipsec’ TCAM profile in two ways: