Arista Captive Portal CVE-2025-6980
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Captive Portal interface
-
ExploitSend crafted portal request
-
ExecutionPortal returns sensitive data
-
ImpactCollect disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the affected Arista device's Captive Portal feature be enabled and network-reachable by the attacker; the Captive Portal is the specific product feature whose exposure the flaw depends on. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication or user interaction is needed and attack complexity is low once the portal endpoint is reachable. Limiting factors: deployments that do not use the Captive Portal feature are not exposed, and reachability of the portal (often on guest/wireless onboarding networks) bounds the attacker population; exact affected versions are not confirmed from the available input. |
| Impact | The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw with high confidentiality impact and no integrity or availability impact - consistent with the CWE-200 classification and the 'Information Disclosure' tag. The exploitation signals, however, temper the raw severity: EPSS is only 0.48% (40th percentile), there is no CISA KEV listing, and no public POC is referenced, so this is 'no public exploit identified at time of analysis.' The signals are coherent rather than conflicting - a genuinely high-confidentiality remote flaw whose exploitation probability is currently assessed as low. No SSVC decision data was provided in the input, so automatable/technical-impact framing cannot be independently confirmed. Net assessment: a legitimate confidentiality concern worth patching on a normal priority cadence for affected Arista captive-portal deployments, but not an emergency 'exploit-imminent' item absent any active-exploitation or POC evidence. Note the scope is bounded to information exposed by the Captive Portal feature specifically, not full device compromise. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Captive Portal web interface sends requests that cause the portal to return sensitive information it should not expose, harvesting that data without credentials or user interaction. No public exploit code is referenced, so exploitation would require an attacker to independently discover the disclosure path. The AV:N/AC:L/PR:N/UI:N vector means the request chain is network-based and technically straightforward once the portal is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Information disclosure in Arista Captive Portal allows remote, unauthenticated attackers to access sensitive data when the feature is enabled and network-reachable. The vulnerability has a CVSS score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating low attack complexity, no authentication or user interaction required, and high confidentiality impact with no integrity or availability impact. Affected are Arista devices with the Captive Portal feature enabled; exact versions are detailed in Arista Security Advisory 0123. No public exploit code is identified at time of analysis, and the EPSS score is 0.48% (40th percentile), suggesting a low likelihood of exploitation activity.
RemediationAI
Apply the fixed version as specified in Arista Security Advisory 0123; the exact version numbers are not provided in the input data, but the vendor advisory provides patched releases. This is the primary remediation. If the Captive Portal feature is not operationally required, disable it entirely-this eliminates exposure but disables guest network onboarding and captive portal functionality. If the feature must remain enabled, restrict network access to the Captive Portal interface using firewall rules or ACLs so that only trusted networks (e.g., management VLANs) can reach it; this reduces the attack surface but may require reconfiguring guest network access. Avoid exposing the Captive Portal to untrusted networks such as public Wi-Fi or the internet. Monitor logs for unusual access to the portal endpoint as a compensating detective control. No public exploit code is identified at time of analysis, but the high confidentiality impact warrants prompt patching.
Affected ProductsAI
The affected product is Arista Captive Portal, a feature available on certain Arista networking devices. Specific version ranges, platforms, and CPE identifiers are not provided in the input data. Arista Security Advisory 0123 (https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123) contains the authoritative list of affected Arista EOS versions and hardware models. Deployments that do not enable the Captive Portal feature are not exposed to this vulnerability. Exact affected versions are not confirmed from the available input.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Captive Portal is a web-based access control mechanism commonly used in guest or public wireless networks to authenticate users before granting internet access. It typically runs on network devices such as Arista switches or access points, presenting a login or terms-of-service page. The vulnerability is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, meaning the portal fails to properly protect sensitive data, allowing an unauthenticated remote attacker to retrieve information that should remain confidential. The CVSS vector confirms network reachability, low complexity, no authentication or user interaction, and high confidentiality impact without integrity or availability impact. The specific root cause-such as insecure direct object reference, information leakage in responses, or misconfiguration-is not detailed in the input data; refer to the vendor advisory for technical specifics. Affected products are identified via the vendor advisory rather than CPE strings in the input.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Captive Portal is network-reachable and the disclosure needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is confidentiality-only (C:H, I:N, A:N) per CWE-200.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
DescriptionCVE.org
Captive Portal can expose sensitive information
Executive ViewAI
Arista Captive Portal information disclosure affects organizations that have the feature enabled and reachable from a network. Because an unauthenticated remote attacker could access sensitive data, leadership should treat this as a potential exposure of confidential information and a risk to network access trust. No public exploit identified at time of analysis, but No vendor-released patch identified at time of analysis warrants immediate exposure reduction and monitoring.
No vendor-released patch identified at time of analysis; interim mitigations include disabling Captive Portal where not required, restricting network reachability to trusted networks via ACLs/firewall rules, segmenting guest/portal traffic, reviewing Arista Security Advisory 0123 for any vendor interim guidance, and monitoring logs for unauthorized or anomalous access to sensitive data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB