CVE-2026-25622
MediumCVSS 6.0Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A command injection vulnerability exists in the Captive Portal Custom Handler of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW), allowing an authenticated administrator to execute arbitrary platform shell commands.
Risk Assessment
The risk involves the ability for an administrator to execute arbitrary commands, potentially leading to full compromise of the firewall system.
Recommendation
Restrict administrative access and apply security patches from the vendor.
Original NVD description (English source)
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.