CVE-2026-25622
Command Injection in Arista Next Generation Firewall
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: Arista Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arista | next_generation_firewall | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection flaw in the Captive Portal Custom Handler of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). It allows an administrative user who is logged into the user interface to exploit improper input handling and execute arbitrary shell commands on the platform.
How can this vulnerability impact me? :
An attacker with administrative access can leverage this vulnerability to run arbitrary commands on the affected system. This could lead to unauthorized control over the firewall platform, potentially compromising system integrity, confidentiality, and availability.