Medium WID-SEC-2026-0350 6 CVEs

Arista NG Firewall: Mehrere Schwachstellen ermöglichen Codeausführung und Cross-Site Scripting

Published Feb 9, 2026 · Updated Jun 7, 2026 · Revision 2 · de-DE

Vendor: Arista Networks Product: NG Firewall

Summary

Ein entfernter Administrator kann mehrere Schwachstellen in Arista NG Firewall ausnutzen, um beliebigen Programmcode auszuführen und Cross-Site-Scripting-Angriffe durchzuführen.

Product

Die Arista Next-Generation Firewall ist eine Netzwerksicherheitslösung, die darauf ausgelegt ist, den Netzwerkverkehr zu inspizieren und Bedrohungen zu blockieren.

Vulnerabilities 6

High 7.2

CVE-2025-6978 EPSS 14%

Diagnostics command injection vulnerability

Diagnostics command injection vulnerability

Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall Network devices Browsers

Oct 23, 2025
Medium 6.0

CVE-2026-25620

Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not e…

Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) Network devices Browsers

Jun 5, 2026
Medium 6.0

CVE-2026-25621

Arista Edge Threat Management NGFW Reports Application Insecure Input Validation

A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) Network devices Browsers

Jun 5, 2026
Medium 6.0

CVE-2026-25622

Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling b…

Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) Network devices Browsers

Jun 5, 2026
Medium 6.0

CVE-2026-25623

Arista Edge Threat Management NGFW UI Arbitrary Command Execution

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal scri…

Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) Network devices Browsers

Jun 5, 2026
Medium 5.7

CVE-2026-25624

Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profi…

Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) Network devices Browsers

Jun 5, 2026

Revision history

2026-06-07 #2
Referenz(en) aufgenommen: EUVD-2026-34909, EUVD-2026-34907, EUVD-2026-34905, EUVD-2026-34903, EUVD-2026-34911
2026-02-09 #1
Initiale Fassung

References

Arista Security Advisory 0133 vom 2026-02-03
https://www.arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133