Cyber Resilience

CVE-2026-25623

RCE in Arista Ng Firewall ≤ 17.4.1

RCECommand Injection
Published
05 June 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 7.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.060 93th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-25623 is a high-severity OS Command Injection (CWE-78) vulnerability in Arista Ng Firewall. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing execution permissions.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CWE-78 OS command injection on public-facing NGFW management interface directly enables T1190 for initial access and T1059.004 for Unix shell command execution by authenticated admins.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-25620Same product: Arista Ng Firewall
CVE-2026-25622Same product: Arista Ng Firewall
CVE-2026-25621Same product: Arista Ng Firewall
CVE-2024-12829Same product: Arista Ng Firewall
CVE-2024-9134Same product: Arista Ng Firewall
CVE-2024-9132Same product: Arista Ng Firewall
CVE-2024-9188Same product: Arista Ng Firewall
CVE-2026-16812Same vendor: Arista
CVE-2024-47520Same product: Arista Ng Firewall
CVE-2024-27889Same product: Arista Ng Firewall

Affected Assets

arista
ng firewall
≤ 17.4.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.5
  • V1.2.8
  • V15.2.5

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of all inputs to the browser management pipeline, blocking the unsanitized data that enables CWE-78 OS command injection.

AC-6 Least Privilege good match
prevent

Enforces least-privilege restrictions on authenticated administrators so that even successful command injection yields only limited terminal execution rights.

SI-2 Flaw Remediation partial match
prevent

Mandates timely remediation of the input-validation flaw in the NGFW management interface, eliminating the root cause of the reported vulnerability.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.

PR.PS-02 partial match
prevents

Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.

References