CVE-2026-25622: Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

Synopsis

A command injection vulnerability exists in the Captive Portal Custom Handler component of Arista Edge Threat Management NGFW (versions up to and including 17.4.0). The vulnerability is reachable over the network by an authenticated administrative user through the product's web-based management interface, with no victim interaction required. Successful exploitation allows the attacker to execute arbitrary shell commands on the underlying platform. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the NGFW management interface over the network; the vulnerable handler is exposed via the web-based UI.

• AuthenticationRequired

  An administrative account is needed; any user holding admin-level privileges in the management UI is sufficient to trigger the injection.

• Victim interactionNot required

  No action by a second user or victim is needed; the attacker interacts directly with the interface on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond holding admin credentials.

Blast Radius

• The attacker executes arbitrary shell commands on the underlying platform, gaining direct OS-level access beneath the firewall application.
• Confidentiality impact is high: the attacker reads sensitive platform data including credentials, configuration files, and stored secrets accessible to the shell.
• Integrity of the host is partially affected: the attacker modifies files, configurations, or persisted state on the platform.
• Availability of the host is partially affected: the attacker disrupts running processes or degrades service operation on the appliance.