Arista NGFW CVE-2026-25624

The attacker must hold high administrative privileges (PR:H per CVSS vector) on the Arista ETM-NGFW web interface - anonymous or low-privileged access is insufficient to inject payloads into the dashboard layout. Additionally, AT:P (Attack Requirements: Present in CVSS 4.0) indicates a specific condition or target state must exist beyond basic network access, though the exact prerequisite is not explicitly named in the available description. A second condition is passive user interaction (UI:P): a victim administrator must browse to the compromised dashboard page, which occurs naturally in normal administrative workflows. Exploitation is limited by the requirement for pre-existing high-level admin access, the AT:P environmental prerequisite, and the administrative web interface being reachable over the network. Exploitation is NOT possible by unauthenticated remote users or low-privileged accounts based on the CVSS PR:H designation.

The CVSS 4.0 score of 5.8 (Medium) reflects a constrained attack path: PR:H requires the attacker to already hold high administrative privileges on the NGFW platform, and AT:P signals that additional attack requirements must be met beyond basic network access. Despite these constraints, VC:H (High confidentiality impact on the vulnerable system) is significant - in an administrative XSS context this most plausibly maps to session token exfiltration or credential capture from a second privileged account, enabling privilege persistence or lateral administrative takeover. UI:P means passive interaction suffices - a victim admin browsing the dashboard triggers the payload without taking any unusual action. No EPSS score was provided in the source data; real-world exploitation probability cannot be quantified from available signals. The absence of both KEV listing and public POC code suggests no confirmed active exploitation or widespread proof-of-concept availability at time of analysis. Overall, real-world risk is moderate: exploitable but requires pre-existing administrative access, limiting the attacker pool to insiders, compromised admin accounts, or multi-stage attack chains.

An attacker who has obtained high-level administrative credentials to the Arista NGFW management interface - through credential theft, insider access, or a prior compromise - injects a malicious JavaScript payload into a user-controlled field within the dashboard layout configuration. When a second administrative user passively browses the affected dashboard page in the normal course of operations, the payload executes in their browser session, allowing the attacker to exfiltrate the victim's session token, capture keystrokes, or perform authenticated actions on their behalf. No public exploit code exists at time of analysis, but the attack technique (stored/reflected XSS targeting admin sessions) is well understood and requires no specialized tooling beyond a browser.