CVE-2025-5090
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedCVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceCVX (a cluster virtualization/control component) lacks proper resilience to unexpected messages from connected switches, causing agent crashes and cluster instability. An attacker with high-privilege access to the connected switch can send crafted TCP packets to trigger this DoS condition.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Verify CVX component is installedRun the command to list installed packages or check for the CVX binary/process (e.g., systemctl status cvx, rpm -qa | grep -i cvx, or ps aux | grep cvx)Affected if CVX software is present on the system
-
Determine CVX versionExecute the version command for CVX (e.g., cvxctl version, cvx --version, or check /opt/cvx/version file)Affected if CVX version cannot be determined or falls within the affected range provided in vendor advisories
-
Identify connected switchesReview CVX configuration files (commonly in /etc/cvx/, /opt/cvx/conf/, or via cvxctl show connections) to list all configured switch peersAffected if Any switch is configured as a peer to CVX
-
Check CVX agent stabilityReview CVX agent logs (typically in /var/log/cvx/agent.log or via journalctl -u cvx-agent) for recent crash events, unexpected restarts, or error messages related to switch communicationAffected if Recent crashes, aborts, or instability events are logged involving switch message handling
-
Inspect network exposure of CVXCheck firewall rules and network ACLs protecting the CVX-switch communication path (typically TCP ports used by CVX for inter-component communication)Affected if The CVX management or switch communication ports are accessible from untrusted networks or non-authorized devices
If CVX is running with configured switch connections, the environment is potentially affected by this DoS vulnerability; check vendor advisories for specific version ranges and apply patches when available.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataSince this is a vendor code-level vulnerability in CVX, organizations should monitor vendor advisories for patches and apply them promptly. In the interim, restrict access to the switch-CV communication path using network segmentation and access controls to limit exposure to authorized devices only.
- Consultation8.0 h
- Implementation16.0 h
- Testing12.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $11,200.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-5090 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-5090 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data