The vulnerability is an encrypted password command injection within the Captive Portal application framework of Arista Edge Threat Management NGFW. It allows an attacker who can influence the password handling process to inject commands, potentially causing unintended behavior. The weakness is classified as CWE-78.

Arista Edge Threat Management – Arista Next Generation Firewall. The issue uniquely affects NGFW version 17.4.0; earlier releases are not exposed.

The CVSS score of 7 indicates a moderate to high severity. The EPSS score of 10% indicates a moderate probability of exploitation, making the likelihood of exploitation moderate. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network-based, targeting the Captive Portal configuration interface, which is typically reachable from trusted administrative networks.