1. Home
  2. CVE Database
  3. CVE-2026-25622
MEDIUM · 6.0

CVE-2026-25622

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logge...

Vulnerability Description

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.

CVSS Score

6.0

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
AristaNg Firewall< 17.4.1

Related Weaknesses (CWE)

CWE-78

References

FAQ

What is CVE-2026-25622?

CVE-2026-25622 is a vulnerability with a CVSS score of 6.0 (MEDIUM). A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logge...

How severe is CVE-2026-25622?

CVE-2026-25622 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-25622?

Check the references section above for vendor advisories and patch information. Affected products include: Arista Ng Firewall.