Arista NGFW EUVD-2026-34907

Requires an authenticated administrative session in the NGFW user interface (CVSS PR:H) and that the attacker can reach the management UI over the network (AV:N). The vulnerable code path is the Captive Portal Custom Handler, so the captive portal feature and the custom handler configuration surface must be reachable by the admin role. Exploitation is limited to users who already hold admin credentials - non-admin operators, read-only roles, and external network users without UI access cannot trigger the flaw; no user interaction by a victim is required (UI:N).

The CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N) confirms remote network reachability with low attack complexity but requires high privileges - an attacker must already hold administrative UI credentials. Subsequent metrics show high confidentiality impact on the vulnerable component (VC:H) with lower integrity/availability impact and a Scope-changed flag (S:P) indicating subsequent system impact, which is consistent with breakout from a constrained admin UI to the underlying OS shell. No EPSS score, KEV listing, or POC data was supplied, so this should be treated as an admin-to-OS privilege escalation rather than a remote unauthenticated takeover; real-world risk is moderate and concentrated on environments where firewall admin credentials may be shared, weak, or already compromised. No public exploit identified at time of analysis.

An attacker who has obtained NGFW administrator credentials - for example via phishing, credential reuse, or a prior compromise - logs into the management UI and edits the captive portal custom handler configuration to embed shell metacharacters or chained commands in a field that the handler later passes to the OS shell. When the handler executes, the injected payload runs on the firewall appliance, giving the attacker a foothold on a network-edge device from which they can pivot, sniff traffic, or disable security controls.