CVE-2026-25622: Arista NGFW Captive Portal Command Injection

Technical summary

CVE-2026-25622 is a command injection flaw (CWE-78) in the Captive Portal Custom Handler component of Arista Edge Threat Management NGFW. The vulnerability stems from insufficient input sanitization in the administrative interface. When an admin submits crafted input to the handler, the application passes unsanitized data directly to platform shell execution functions, enabling arbitrary command execution. The attack requires network access to the management interface and valid high-privilege credentials, but requires no user interaction beyond the initial malicious input submission.

Business impact

Compromise of an Arista NGFW can have severe downstream consequences. A threat actor gaining command execution on the firewall can inspect network traffic, modify security policies, disable logging, intercept encrypted sessions, pivot to internal networks, or use the appliance as a beachhead for broader infrastructure attacks. For organizations relying on this firewall as a perimeter control, the risk is elevated because the compromise occurs at a critical chokepoint. Regulatory compliance obligations (PCI-DSS, HIPAA, SOC 2) may be affected if breach investigation reveals the appliance was compromised.

Affected systems

Arista Edge Threat Management - Next Generation Firewall (NGFW) platforms are affected. The vulnerability is specific to the Captive Portal Custom Handler feature and only exploitable by users with administrative privileges. Verify your Arista NGFW firmware version against Arista's security advisory to determine if your deployment is in scope. Isolated or offline firewall management networks provide some mitigation but do not eliminate risk if admin credentials are compromised.

Exploitability

Exploitability is moderate in a typical environment. The attack requires valid administrative credentials, which are high-value targets for credential theft, insider threats, or compromised supply chains. The network path to the management interface typically exists only for authorized administrators, limiting opportunistic exploitation. However, once credentials are obtained, the attack is trivial to execute and does not require social engineering or user interaction. There is no evidence of active exploitation in the wild, and this CVE is not on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Arista has released security patches addressing this input validation flaw. Immediately apply the vendor's patched firmware version to all affected NGFW appliances. Verify patch details directly in Arista's official security advisory. In parallel, implement compensating controls: restrict administrative interface access to a dedicated jump host or VPN, enforce multi-factor authentication for admin accounts, audit admin login and command execution logs, and rotate credentials for any accounts that may have been exposed or used to test the issue.

Patch guidance

Contact Arista support or consult their security advisories to identify the specific patched firmware version(s) for your NGFW model. Prioritize patching production firewalls in a staged approach to avoid service interruption. Test patches in a non-production environment first, paying attention to any breaking changes in the Captive Portal Custom Handler feature. Schedule maintenance windows outside business hours if possible. Verify patch installation by confirming the firmware version in the management console and re-testing the Captive Portal Custom Handler functionality post-upgrade.

Detection guidance

Monitor admin authentication logs for unusual login patterns, especially from unexpected IP addresses or outside business hours. Inspect command execution logs for unfamiliar shell commands or administrative actions that deviate from normal operations. If detailed logging of handler input is available, look for special characters, command separators, or system command keywords (e.g., bash, sh, exec, curl, wget) embedded in Captive Portal Custom Handler configuration fields. Network-level detection is challenging because the attack traverses the legitimate management interface; focus on endpoint and application-level logging.

Why prioritize this

This vulnerability merits prompt attention because it affects a critical security control (the firewall perimeter) and requires only internal credentials to exploit. The CVSS score of 6.0 reflects medium overall severity, but the context matters: administrative compromise of a firewall is high-impact even if the likelihood is currently lower than a zero-day affecting a public-facing feature. The lack of KEV catalog inclusion and evidence of active exploitation suggests this is a responsible-disclosure scenario, giving defenders a window to patch before weaponization becomes widespread.

Risk score, explained

The CVSS 3.1 score of 6.0 (Medium) is driven by the following vector components: Network accessible (AV:N), low attack complexity (AC:L), requiring high privileges (PR:H), no user interaction (UI:N), unchanged scope (S:U), with high confidentiality impact (C:H), low integrity impact (I:L), and low availability impact (A:L). The high-privilege requirement substantially lowers the base score from what would be critical for an unauthenticated vulnerability. However, in real-world risk assessment, organizations should consider that admin credential compromise—whether through phishing, insider threats, or lateral movement—is a non-zero probability, especially in larger enterprises.

Frequently asked questions