EUVD-2026-34911
GHSA-5h7h-rxr9-2ccv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (arista) · only source for this CVE.
CVSS VectorVendor: arista
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.
AnalysisAI
Cross-site scripting in the Arista Edge Threat Management Next Generation Firewall web UI dashboard allows a high-privileged attacker to inject unvalidated input that is reflected back into administrative profiles, enabling script execution in the context of other administrative sessions. The vulnerability carries a CVSS 4.0 score of 5.8 (Medium), with confidentiality impact rated High on the vulnerable system - consistent with session token or credential harvesting from targeted admin accounts. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input incorporated into the dashboard layout is not sanitized or output-encoded before being rendered in administrative views. The CVSS 4.0 vector specifies AV:N (network-delivered), AC:L (low complexity once access is obtained), AT:P (attack requirements present - some non-standard prerequisite or target state required), PR:H (attacker must hold high administrative privileges to inject the payload), and UI:P (passive interaction - a victim admin need only browse to the affected dashboard page). The affected surface is the web user interface dashboard layout of Arista ETM-NGFW, a network security appliance platform. The 'echoed back to administrative profiles' phrasing in the description is consistent with a stored or DOM-based XSS variant rather than a simple reflected GET-parameter injection, as payloads persist into the context of other administrative sessions.
RemediationAI
The primary remediation action is to consult and apply guidance from the Arista PSIRT security advisory published at https://www.arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133. No specific patched version number was included in the available intelligence data; organizations should check the advisory directly for the exact fixed release. As a compensating control pending patching, restrict administrative web UI access to trusted management networks or VPN-only egress using firewall ACLs or management plane access-lists - this raises the effective Attack Vector from network-reachable to management-plane-only, significantly reducing exploitation opportunity. Additionally, enforce multi-session monitoring and alert on unexpected administrative logins or dashboard access patterns. Note that restricting UI access does not remediate the underlying input validation defect and should not substitute for patching. Disabling the dashboard layout feature entirely (if operationally feasible) eliminates the vulnerable surface while a patch is applied.
More in Ng Firewall
View allArista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8)
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8),
Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 7.3
The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user. Rat
The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColu
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) Captive Portal Custom Handler allows
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows authenticated h
Authenticated command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) allows administrators w
Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows high-privileged
Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. Rated medium severity (CVSS 6.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today