Ng Firewall vulnerabilities

6 known vulnerabilities in Ng Firewall from Arista Networks. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  NG Firewall: Improper Neutralization of Input During Web Page Generation

  CVE-2025-2767Apr 23, 2025Arista Networks

  Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this v

• 8.3 High severity

  Arista Edge Threat Management: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-9134Jan 10, 2025Arista Networks

  Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

• 7.8 High severity

  NG Firewall: Incorrect Authorization

  CVE-2024-12831Dec 20, 2024Arista Networks

  Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-

• 7.3 High severity

  NG Firewall: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-12830Dec 20, 2024Arista NetworksEPSS 1.02%

  Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this vuln

• 8.8 High severity

  NG Firewall: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-12829Dec 20, 2024Arista NetworksEPSS 1.29%

  Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerabi

• 8.8 High severity

  Arista Edge Threat Management - Arista NG…: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-27889Mar 4, 2024Arista NetworksEPSS 8.79%

  Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands o