Critical severity · published Apr 23, 2025
CVE-2025-2767
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability
9.6
CVSS
0.7%
EPSS
No
On KEV
Description
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this vulnerability.
The specific flaw exists within the processing of the User-Agent HTTP header. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24407.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
NG Firewall · Arista
17.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2767
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-181/
More from NG Firewall
9.8
CVE-2024-9132
The administrator is able to configure an insecure captive portal script
8.8
CVE-2024-9188
Specially constructed queries cause cross platform scripting leaking administrator tokens
8.8
CVE-2024-12829
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability
8.8
CVE-2024-27889
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW)
8.3
CVE-2024-9134
Multiple SQL Injection vulnerabilities exist in the reporting application