EUVD-2026-34903
GHSA-533r-r386-qc78
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (arista) · only source for this CVE.
CVSS VectorVendor: arista
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
AnalysisAI
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows authenticated high-privileged remote attackers to inject OS commands through the Captive Portal application framework via encrypted password handling. The flaw is unique to release 17.4.0 with earlier versions unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score of 7.0 reflects high attacker privilege requirement balanced against high confidentiality impact on the firewall appliance.
Technical ContextAI
Arista Edge Threat Management NGFW (formerly Untangle) is a network security appliance providing firewalling, content filtering, and captive portal authentication for guest/BYOD network access. The Captive Portal framework intercepts unauthenticated client traffic and presents a login page; the encrypted password handling path in version 17.4.0 contains a CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw, meaning user- or admin-supplied input flows into a shell command without proper sanitization. Because the injection occurs in the password decryption/handling routine rather than in the public-facing portal page itself, exploitation requires sufficient privilege to submit content that traverses that code path.
RemediationAI
Consult the Arista security advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/22867-security-advisory-0133 for the fixed release - patch availability per vendor advisory but an exact fixed version was not provided in the input data. Until the vendor-supplied fix is applied, compensating controls include restricting NGFW administrative and Captive Portal management access to a dedicated management VLAN reachable only from trusted admin workstations (trade-off: blocks legitimate remote admin from untrusted networks), enforcing MFA on all admin accounts to raise the bar on the PR:H prerequisite, and auditing/rotating any admin credentials and pre-shared captive portal secrets that may have transited the vulnerable code path. Because the flaw only affects 17.4.0, rolling back to a prior unaffected release is a viable temporary option if downgrade paths are supported in your deployment, though feature regressions in the 17.4.0 release notes should be reviewed first.
More in Ng Firewall
View allArista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8)
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8),
Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 7.3
The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user. Rat
The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColu
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) Captive Portal Custom Handler allows
Authenticated command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) allows administrators w
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows high-privileged
Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. Rated medium severity (CVSS 6.
Cross-site scripting in the Arista Edge Threat Management Next Generation Firewall web UI dashboard allows a high-privil
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today