The vulnerability is a command injection flaw in the Captive Portal Custom Handler of Arista Edge Threat Management NGFW. An administrative user logged into the web interface can supply input that is executed as shell commands on the platform. The flaw is identified as CWE-78 and allows attackers to run arbitrary commands, leading to full control over the firewall appliance. Compromise of this system would disclose sensitive network topology and could allow lateral movement or service disruption.

Affected systems are Arista Networks' Arista Edge Threat Management – Arista Next Generation Firewall. Versions prior to NGFW 17.4.1 are impacted. The official advisory does not list all affected build numbers, but it recommends upgrading to version 17.4.1 to remediate the flaw.

The CVSS score of 7.0 indicates a high severity with exploitable impact when an attacker has administrative access. The EPSS score is 10%, but the advisory does not indicate active exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to access the administrative browser with legitimate credentials and then exploit the input handling to inject commands. Without administrative access or a valid session, the attack vector would be limited, so the intrinsic exploitability is moderate.