CVE-2026-25622

Vulnerability

A command injection vulnerability exists in the Captive Portal Custom Handler component of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) [1]. This issue affects affected platforms where an administrative account logged into the user interface can exploit this input handling behavior.

Exploitation

An attacker with administrative privileges logged into the Arista NGFW user interface can exploit this vulnerability by interacting with the Captive Portal Custom Handler. The attacker needs to provide specially crafted input to the handler, which is then processed in a way that allows for arbitrary platform shell commands to be executed [1].

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary platform shell commands with the privileges of the affected application. This could lead to unauthorized access, modification, or deletion of data, and potentially compromise the entire system [1].

Mitigation

Arista has released Security Advisory 0133 detailing this vulnerability, but a fixed version or specific mitigation steps are not yet disclosed in the available references [1]. Users are advised to monitor Arista's support page for updates regarding patches or workarounds.