CVE-2026-25620

MediumCVSS 6.0

Published: 05/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

9.88%

95th percentile - higher than 95% of all known CVEs

Summary

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) version 17.4.0, allowing execution of arbitrary shell commands.

Risk Assessment

The risk involves the ability for an attacker to execute arbitrary commands, potentially leading to full compromise of the firewall system.

Recommendation

Immediately update to version 17.4.1 or later that fixes this vulnerability.

Original NVD description (English source)

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.