CVE-2026-25620

MEDIUM 6.0CVE-2026-25620 · Published 05/06/2026 · updated 23/07/2026

In short

CVE-2026-25620 is a MEDIUM (CVSS 6.0) vulnerability affecting ng firewall (arista).
Chance of exploitation in the next 30 days (EPSS): 9.3%, higher than 95.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ng firewall arista	`= 17.4`	No fix yet

Description

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

References

arista.com/en/support/advisories-notices/security-advisory/22867-security-advisory-0133 · Mitigation

More vulnerabilities in ng firewall

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ng firewall

arista

= 17.4

No fix yet

More vulnerabilities in ng firewall

See all →