CVE-2026-25620

Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

CVSS 4.0 · 7 High EPSS 9.3% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25621

Arista Edge Threat Management NGFW Reports Application Insecure Input Validation

A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25622

Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.

CVSS 4.0 · 7 High EPSS 9.3% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25623

Arista Edge Threat Management NGFW UI Arbitrary Command Execution

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing execution permissions.

CVSS 4.0 · 7 High EPSS 5.6% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25624

Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2025-6978

Diagnostics command injection vulnerability

Diagnostics command injection vulnerability

CVSS 3.1 · 7.2 High EPSS 14.1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2025-6980

Captive Portal can expose sensitive information

Captive Portal can expose sensitive information

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2025-6979

Captive Portal can allow authentication bypass

Captive Portal can allow authentication bypass

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-9134

Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-27889

Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).

Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

CVSS 3.1 · 8.8 High EPSS 8.8% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-9133

A user with administrator privileges is able to retrieve authentication tokens

A user with administrator privileges is able to retrieve authentication tokens

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-9132

The administrator is able to configure an insecure captive portal script

The administrator is able to configure an insecure captive portal script

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-9131

A user with administrator privileges can perform command injection

A user with administrator privileges can perform command injection

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-47520

A user with advanced report application access rights can perform actions for which they are not authorized

A user with advanced report application access rights can perform actions for which they are not authorized

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-47519

Backup uploads to ETM subject to man-in-the-middle interception

Backup uploads to ETM subject to man-in-the-middle interception

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-47518

Specially constructed queries targeting ETM could discover active remote access sessions

Specially constructed queries targeting ETM could discover active remote access sessions

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-47517

Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access

Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-9188

Specially constructed queries cause cross platform scripting leaking administrator tokens

Specially constructed queries cause cross platform scripting leaking administrator tokens

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2025-2767

Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability

Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the processing of the User-Agent HTTP header. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24407.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall

CVE-2024-12832

Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability

Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files and disclose sensitive information on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability. The specific flaw exists within the ReportEntry class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the www-data user. Was ZDI-CAN-24325.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Ng Firewall