CVE-2026-25623: Arista Edge Threat Management NGFW UI Arbitrary Command Execution

Synopsis

An input validation flaw in the browser-based management UI of Arista Edge Threat Management Next Generation Firewall (NGFW) allows command execution on the underlying host. The vulnerability is reachable over the network and requires a valid administrator account to exploit, derived from the CVSS vector (AV:N, PR:H). Successful exploitation grants an attacker the ability to execute arbitrary terminal commands on the firewall host, with partial impact on confidentiality, integrity, and availability of both the local and adjacent scope. No fix version has been published by Arista; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the NGFW management UI over the network; the service must be exposed to the attacker's network path.

• AuthenticationRequired

  A valid administrator account is required; the attacker must possess or compromise high-privilege credentials before exploiting the flaw.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker operates entirely through their own authenticated session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• Reads sensitive data accessible to the underlying host process, including configuration files, credentials, and stored session material.
• Modifies files or runtime state on the firewall host within the permissions of the executing process.
• Partially disrupts normal operation of the firewall service, affecting traffic inspection and availability.
• Produces limited spillover impact on adjacent systems or services connected to the firewall's management plane.