CVE-2026-25620: Arista NGFW Command Injection in Captive Portal (v17.4.0)

Technical summary

CVE-2026-25620 is a command injection vulnerability (CWE-78) in the Captive Portal application framework of Arista NGFW version 17.4.0. The flaw resides in inadequate input validation of an encrypted password parameter, permitting authenticated high-privilege users to inject arbitrary OS commands. The vulnerability does not affect earlier software releases, indicating it was introduced or exposed in the 17.4.0 development cycle. Attack complexity is low once authentication is obtained, and the impact spans confidentiality (data exfiltration), integrity (system modification), and availability (potential service disruption).

Business impact

An authenticated administrator could exploit this to execute arbitrary commands on the firewall itself, potentially allowing lateral movement within protected networks, exfiltration of firewall configuration and logs, or deployment of persistence mechanisms. Given that firewalls often sit in critical network paths, compromise could expose sensitive traffic flows and enable long-term reconnaissance. The requirement for high-privilege credentials narrows the attack surface but does not eliminate risk in environments where administrative access is shared or compromised.

Affected systems

Only Arista NGFW version 17.4.0 is affected. Users on earlier versions are not exposed by this specific flaw. Organizations must inventory deployed instances and identify any systems running exactly version 17.4.0 in production or testing environments.

Exploitability

Exploitation requires high-privilege (administrative) credentials and network access to the firewall's management interface. There is no indication of active exploitation or public proof-of-concept code. The low attack complexity means that once an attacker holds valid high-privilege credentials, the technical barrier to command injection is minimal. This remains a concern in environments where administrative credentials are shared, insufficiently rotated, or accessible to insider threats.

Remediation

Organizations must upgrade Arista NGFW deployments from version 17.4.0 to a patched release. Verify the specific patched version against the Arista vendor advisory, as version numbers depend on the maintenance release cycle and support timeline. Concurrent mitigations include restricting administrative access via network segmentation, enforcing multi-factor authentication for firewall logins, and monitoring for anomalous command execution on firewall instances.

Patch guidance

Contact Arista for the recommended patched version for your NGFW deployment. Arista typically releases maintenance patches through their standard support channels. Test patches in a non-production environment to ensure compatibility with your network configuration, especially given the firewall's critical role. Plan maintenance windows with appropriate change control and rollback procedures. Verify patch installation by confirming the software version post-update and re-scanning with vulnerability assessment tools.

Detection guidance

Monitor firewall logs for unusual command execution attempts originating from the captive portal application or administrative interfaces. Look for suspicious process spawning, unexpected file modifications in system directories, or connections to external command-and-control infrastructure from the firewall itself. Network behavior analysis may reveal compromised firewalls attempting reconnaissance or lateral movement. Compare deployed NGFW versions against inventory to identify systems still running 17.4.0. Consider scanning for the specific vulnerability using authenticated vulnerability scanners that test for CWE-78 injection flaws in this product.

Why prioritize this

This vulnerability merits prompt but measured attention. The CVSS score of 6.0 (MEDIUM) reflects the high-privilege requirement, which substantially limits attack surface compared to unauthenticated flaws. However, the impact on confidentiality is high, and compromise of a firewall is a critical network security event with downstream consequences. The narrow version scope (17.4.0 only) simplifies inventory and limits the exposed install base. Organizations not running version 17.4.0 can deprioritize this issue, while those who are should schedule patching within normal maintenance windows—not emergency procedures—unless they operate in high-threat environments or have reason to believe admin credentials are compromised.

Risk score, explained

The CVSS 3.1 score of 6.0 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), high privilege requirement (PR:H), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality impact (C:H) balanced against low integrity and availability impacts (I:L/A:L). The mandatory high-privilege prerequisite prevents a higher severity rating despite the potentially severe consequences of firewall compromise. Organizations with strong access controls and credential hygiene should view this as moderate risk; those with weak administrative segmentation or shared admin accounts should elevate internal risk scoring.

Frequently asked questions