What’s Vulnerable › Products
Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) vulnerabilities
20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Latest Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) vulnerabilities
- CVE-2026-25624 — Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting (CVSS 4.8)
- CVE-2026-25623 — Arista Edge Threat Management NGFW UI Arbitrary Command Execution (CVSS 6.0)
- CVE-2026-25622 — Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection (CVSS 6.0)
- CVE-2026-25621 — Arista Edge Threat Management NGFW Reports Application Insecure Input Validation (CVSS 6.0)
- CVE-2026-25620 — Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection (CVSS 6.0)
- CVE-2025-2767 — Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability (CVSS 9.6)
- CVE-2024-9188 — Specially constructed queries cause cross platform scripting leaking administrator tokens (CVSS 8.8)
- CVE-2024-9134 — Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges. (CVSS 8.3)
- CVE-2024-9133 — A user with administrator privileges is able to retrieve authentication tokens (CVSS 5.6)
- CVE-2024-9132 — The administrator is able to configure an insecure captive portal script (CVSS 9.8)
- CVE-2024-9131 — A user with administrator privileges can perform command injection (CVSS 7.2)
- CVE-2024-47520 — A user with advanced report application access rights can perform actions for which they are not authorized (CVSS 7.6)
- CVE-2024-47519 — Backup uploads to ETM subject to man-in-the-middle interception (CVSS 7.1)
- CVE-2024-47518 — Specially constructed queries targeting ETM could discover active remote access sessions (CVSS 7.6)
- CVE-2024-47517 — Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access (CVSS 6.8)
- CVE-2024-12832 — Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability (CVSS 6.3)
- CVE-2024-12831 — Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability (CVSS 7.8)
- CVE-2024-12830 — Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability (CVSS 7.3)
- CVE-2024-12829 — Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability (CVSS 8.8)
- CVE-2024-27889 — Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). (CVSS 8.8)