Which versions of Arista NGFW are affected by CVE-2026-25623?

Arista Edge Threat Management NGFW contains an authenticated command injection vulnerability (CVE-2026-25623) allowing administrative users to execute arbitrary code on firewall appliances, creating…

How to fix or mitigate CVE-2026-25623?

24-hour: Inventory all Arista NGFW instances and document administrative access control lists; identify any non-essential administrative users or remote access. 7-day: Implement network-based access controls restricting management interface connectivity to authorized networks only; require multi-factor authentication for all administrative access; increase monitoring and alerting on admin sessions. 30-day: Establish communication channel with Arista for patch timeline; develop migration plan to patched versions or alternative firewalls once available; conduct security audit of all recent administrative activities.

Arista NGFW CVE-2026-25623

Q: What is the CVSS score of CVE-2026-25623?

CVE-2026-25623 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34909 HIGH

OS Command Injection (CWE-78)

2026-06-05 psirt@arista.com

GHSA-q9j2-m53h-872m

Command Injection Ng Firewall

7.0

CVSS 4.0 · Vendor: arista

Severity by source

Vendor (arista) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (arista) · only source for this CVE.

CVSS VectorVendor: arista

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:35 vuln.today

DescriptionCVE.org

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing execution permissions.

AnalysisAI

Authenticated command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) allows administrators with existing access to the browser management pipeline to break out and execute arbitrary terminal/shell script code on the underlying appliance OS. The flaw stems from insufficient input validation (CWE-78) within management-plane functionality and carries a CVSS 4.0 score of 7.0 with no public exploit identified at time of analysis. Because exploitation requires high-privileged authentication, the issue is a privilege-boundary breach rather than an unauthenticated remote takeover.

Technical ContextAI

Arista's Edge Threat Management NGFW (the former Untangle platform) is a security appliance whose browser-based administration console wraps backend system functions. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that one or more management endpoints construct shell commands or invoke a script interpreter using attacker-controllable input without adequate sanitization or argument separation. The CVSS vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the description's reference to the 'browser management pipeline' point to an HTTP-reachable admin function that passes parameters through to a shell, allowing an authenticated administrator to escape the intended command structure and run arbitrary terminal-level code under the privileges of the management daemon. No specific CPE data was supplied in the input, so the exact subsystem within NGFW cannot be pinpointed from public NVD references alone.

RemediationAI

Patch status from the available data is best described as: patch available per vendor advisory - consult Arista Security Advisory 0133 (https://www.arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133) for the exact fixed version and upgrade path, as no specific fix version was supplied in the input data and version numbers should not be invented. Until upgrade, compensating controls include restricting access to the NGFW web administration interface to a dedicated management VLAN or jump host (trade-off: legitimate remote admin workflows must be routed through that path), enforcing MFA and unique credentials for every administrative account to reduce the likelihood that PR:H is satisfied by a stolen password, auditing admin accounts and removing unused ones, and reviewing management-plane access logs for unusual command sequences or parameter values consistent with shell metacharacters being submitted via the browser UI.