CVE-2026-25622CWE-78
Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection
High · published June 5, 2026
What it is
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.
The record
Technical detail
- CVSS v4.0
- 7.0 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/S:P
- EPSS
- 0.00975 · 61.7th percentile
- Weakness
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2026-06-05T19:29Z
EPSS history
Timeline