CVE-2026-25620: Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection
Published Jun 5, 2026
·Updated
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.
Affected Software
2 affected components
Arista Arista Edge Threat Management NGFW=17.4.0
Arista NG Firewall=17.4
Remediation
Information
The recommended resolution is to upgrade to NGFW Version 17.4.1 at your earliest convenience.
Event History
Jun 5, 2026
CVE Published
via MITRE·07:26 PM
Data Sourced
via MITRE·07:26 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-25620?
The severity of CVE-2026-25620 is rated as medium with a score of 6.
2
How do I fix CVE-2026-25620?
To address CVE-2026-25620, upgrade to NGFW Version 17.4.1 at your earliest convenience.
3
What type of vulnerability is CVE-2026-25620?
CVE-2026-25620 is an OS command injection vulnerability in the Captive Portal application framework.
4
Which version of Arista Edge Threat Management NGFW is affected by CVE-2026-25620?
Only version 17.4.0 of Arista Edge Threat Management NGFW is affected by CVE-2026-25620.
5
Does CVE-2026-25620 affect earlier releases of Arista Edge Threat Management NGFW?
No, earlier software releases are not exposed to CVE-2026-25620.