Arista Captive Portal
CVE-2025-6979
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach captive portal network interface
-
DeliveryDeliver crafted request/link to user
-
ExploitUser interaction triggers auth-bypass flaw
-
ExecutionBypass portal authentication
-
ImpactGain unauthorized network access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the affected Arista Captive Portal feature to be deployed and in use (typically guest/onboarding network access control on Arista wireless/edge infrastructure) - environments not using captive portal are not exposed. Per the CVSS vector, the attacker needs network reachability to the portal (AV:N) and no credentials (PR:N), but a user interaction is required (UI:R), which limits fully automated or drive-by mass exploitation. The provided description does not name the specific configuration setting or protocol step that triggers the bypass, so defenders should consult Arista advisory SA-0123 for the exact affected deployment modes and versions before scoping exposure. |
| Impact | This is a genuine high-severity issue but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw with full CIA impact, which is why it scores HIGH. However, two signals temper the real-world urgency: the vector requires user interaction (UI:R), and the EPSS score is low at 0.53% (43rd percentile), indicating no current indication of active or automated exploitation. There is no CISA KEV listing and no public POC in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis.' The SSVC-style read is: exploitation = none observed, automatable = likely no (user interaction gate), technical impact = total. Net: prioritize patching for environments running the affected Arista captive-portal feature, but the UI:R requirement plus low EPSS suggests opportunistic mass exploitation is unlikely in the near term. One caveat to verify: the description ('Captive Portal can allow authentication bypass') is extremely terse and does not itself explain how network-vector unauthenticated access combines with required user interaction - confirm the exact trigger with the Arista advisory (SA-0123). |
| Exploit ScenarioDerived | An attacker positioned to reach a guest/captive-portal network interface induces a victim to interact with a crafted request or link, bypassing the portal's authentication check and gaining the network access or session the portal was meant to gate. Because PR:N applies, the attacker needs no prior credentials, but UI:R means a user action is part of the chain. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authentication bypass in Arista's Captive Portal (CVE-2025-6979, documented as security advisory SA-0123) allows a remote, unauthenticated attacker to reach resources that the portal is supposed to protect, with high impact to confidentiality, integrity and availability (CVSS 8.8). Exposure is limited to environments where the captive portal feature is actually deployed - typically guest or onboarding access control on Arista wireless and edge infrastructure - and the assessed vector requires user interaction (UI:R), which rules out fully automated, drive-by mass exploitation but not targeted social-engineering attacks against guests. Risk is meaningful for organizations running guest portals, although EPSS is low (0.53%, roughly the 43rd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; treat this as a genuine high-severity issue requiring prompt patching rather than an emergency.
RemediationAI
Patch status is not confirmed from the available input data - no fix version is given here - so the first action is to retrieve Arista security advisory SA-0123 (https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123), identify the exact fixed firmware/EOS release it specifies, and upgrade all devices running the captive portal to that version; do not assume any specific version number until the advisory confirms it. If the portal is not operationally required, disabling the captive portal feature removes the attack surface outright, at the cost of losing guest self-service onboarding. Where the portal must stay enabled, isolate the guest portal into its own VLAN or VRF with no routing or policy path to internal corporate, management, or data-center networks, and restrict portal reachability to only the guest SSIDs/subnets that need it - this limits blast radius but does not fix the bypass itself. Additional compensating controls include layering a secondary authentication mechanism (for example 802.1X, MAC authentication bypass, or per-guest credentials) on top of the portal, which adds onboarding friction, and enabling logging/alerting on portal authentication events and guest-segment traffic so attempts to reach protected resources after portal interaction are detected. Note that the assessed vector requires user interaction (UI:R), so user awareness messaging about unexpected portal prompts is a useful secondary control, and no public exploit code has been identified at time of analysis.
Affected ProductsAI
The affected product is the Arista Captive Portal feature, referenced by Arista PSIRT (psirt@arista.com) in security advisory SA-0123 at https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123 (note the advisory link in the source data contains a duplicated 'https://' prefix). Deployments at risk are those using captive portal for guest or onboarding network access control, typically on Arista wireless and edge infrastructure; environments that do not enable the captive portal feature are not exposed. The dataset provides no CPE identifiers and no explicit version ranges, so the exact affected product generations, firmware/EOS versions, and supported deployment modes (for example centralized versus locally hosted portal configurations) must be confirmed against advisory SA-0123 before scoping an installation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-287 (Improper Authentication) and affects the captive portal authentication flow, the web-based interception mechanism that redirects unauthenticated clients to a login or acknowledgement page before granting network access. Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the attacker needs only network reachability to the portal and no credentials, but must induce a victim user to interact with the portal, and a successful bypass yields full compromise of confidentiality, integrity and availability within the affected scope. No CPE strings were supplied with this record, so the precise affected hardware/software product lines and firmware trains must be taken from Arista advisory SA-0123 rather than inferred; the advisory is the authoritative source because the available data does not name the specific configuration setting, portal mode, or protocol step that triggers the bypass.
Know when Arista gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable captive portal (AV:N) with no credentials (PR:N) but a required user action (UI:R); an authentication bypass yields full access to the gated network, so C/I/A:H.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
DescriptionCVE.org
Captive Portal can allow authentication bypass
Executive ViewAI
Arista's Captive Portal, used for guest and onboarding access control on wireless and edge infrastructure, contains an authentication bypass vulnerability (CVE-2025-6979) that can allow a remote attacker to reach resources the portal is meant to protect. Organizations with this feature deployed face potential unauthorized access to sensitive network segments, with high impact to confidentiality, integrity, and availability. Although no public exploit identified at time of analysis and the assessed vector requires user interaction, the high severity warrants prompt mitigation to protect guest-facing services and downstream assets.
Disable captive portal if not essential; restrict network access to captive portal management interfaces; implement network segmentation; monitor for unauthorized access attempts; apply vendor workarounds from advisory SA-0123.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly oth
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential d
GitHub PoC
Exploit-DB