Arista NGFW CVE-2026-25620

Target must be running exactly Arista NGFW version 17.4.0 with the Captive Portal application framework deployed and reachable by the attacker. Attacker must already hold high-privilege credentials (CVSS PR:H) on the NGFW - this is not exploitable by unauthenticated portal users or by guest clients hitting the captive portal login page. The vulnerable code path is specifically the encrypted password handling within the Captive Portal framework, so deployments that have not enabled or configured Captive Portal are not exposed. No user interaction is required (UI:N) once the attacker has the necessary privileges and network reach to the management surface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L) shows network reach with low attack complexity but high privileges required, materially limiting blast radius - an attacker already needs admin-tier access to the NGFW management surface. With high confidentiality impact and low integrity/availability impact on the vulnerable component plus subsequent low impact on adjacent systems, this is a credential/configuration exposure risk more than a takeover primitive. No EPSS score, KEV listing, or public POC was supplied, so exploitation appears theoretical at this time; however, the narrow version exposure (only 17.4.0) suggests this was caught via vendor code review or coordinated disclosure rather than in-the-wild discovery. Defenders running 17.4.0 should still treat this as priority patching because compromise of the firewall management plane has outsized downstream consequences even when PR:H is required.

An attacker who has obtained or compromised a high-privileged NGFW administrator account (for example via phishing, credential reuse, or insider access) reaches the management interface over the network and submits a crafted payload through the Captive Portal encrypted password handling path. The injected shell metacharacters execute in the context of the captive portal service, allowing the attacker to read sensitive firewall configuration, captured credentials, or portal session data. No public exploit identified at time of analysis, so any operational exploitation would require independent vulnerability research.