CVE-2026-25620: Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection

Synopsis

This is a command injection vulnerability in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW), affecting only version 17.4.0. The vulnerability is reachable over the network and requires high-privilege (admin-level) credentials to exploit. Successful exploitation gives an attacker the ability to read sensitive data, make limited modifications, and cause partial service disruption on both the affected component and connected systems. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Captive Portal service over the network; local or physical access is not sufficient on its own.

• AuthenticationRequired

  Exploitation requires a high-privilege (admin-level) account on the affected system; low-privilege credentials are not sufficient.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the vulnerability without involving any other party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other variable environmental factors.

Blast Radius

• Reads sensitive data from the vulnerable component, including potentially encrypted password material handled by the Captive Portal framework.
• Makes limited modifications to data on the affected component and adjacent connected systems.
• Causes partial degradation of the affected service and limited impact on availability of connected system components.
• Scope is marked as Subsequent (physical) in the vector, meaning impact can extend beyond the primary vulnerable component to neighbouring systems.