--- title: 1 unread message | daily.dev description: Bishop Fox disclosed six vulnerabilities in Arista NG Firewall version 17.4, including multiple arbitrary command injection flaws that allow root-level code... canonical: https://daily.dev/posts/1-unread-message-uwku08yp4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 1 unread message | daily.dev og:description: Bishop Fox disclosed six vulnerabilities in Arista NG Firewall version 17.4, including multiple arbitrary command injection flaws that allow root-level code... og:url: https://daily.dev/posts/1-unread-message-uwku08yp4 og:image: https://api.daily.dev/og/posts/uwKu08yP4.png og:image:alt: 1 unread message og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 1 unread message **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 9 min read · 0 upvotes · 0 comments ## Summary Bishop Fox disclosed six vulnerabilities in Arista NG Firewall version 17.4, including multiple arbitrary command injection flaws that allow root-level code execution, an insecure backup restore path leading to PostgreSQL command execution, an overly permissive JSON-RPC interface, and a reflected XSS bug. Several flaws could be chained together to achieve one-click remote code execution against a logged-in administrator, and one issue could be triggered by an unauthenticated attacker under specific Captive Portal configurations. Arista published Security Advisory 0133 and released version 17.4.1 on February 3, 2026, which patches all six issues (CVE-2025-6978, CVE-2026-25620 through CVE-2026-25624). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities were fixed in Arista NG Firewall 17.4.1? Arista NG Firewall 17.4.1, released February 3, 2026, fixes six vulnerabilities discovered by Bishop Fox: CVE-2025-6978 and CVE-2026-25620 through CVE-2026-25624. These include arbitrary command injection in the diagnostics feature, a password encryption helper, the Captive Portal custom handler, an overly permissive RPC interface, insecure input validation in the Reports backup/restore feature, and a reflected XSS bug, several of which allowed root-level code execution. _Track newly patched firewall CVEs like these on daily.dev before attackers exploit unpatched systems._ ### How could the Arista NG Firewall XSS and RPC vulnerabilities be chained for remote code execution? Reflected XSS on the /quarantine endpoint (CVE-2026-25624) could be combined with the overly permissive JSON-RPC interface (CVE-2026-25623) to achieve one-click remote code execution. Tricking a logged-in administrator into visiting a malicious URL triggered JSON-RPC calls in their browser, which accessed the exposed ExecManager interface to execute arbitrary commands as root on the appliance. _Developers building admin interfaces can study real exploit chains like this one on daily.dev._ ### How was the CVE-2026-25620 password encryption command injection vulnerability fixed in Arista NG Firewall? The vulnerable PasswordUtil.getEncryptPassword method built a shell command by concatenating unsanitized user-supplied passwords into a string, allowing arbitrary command injection with root privileges. Version 17.4.1 fixes this by switching to Java's ProcessBuilder with tokenized input instead of raw shell string concatenation, preventing injected shell metacharacters from being interpreted as separate commands. _Engineers hardening Java command execution code can find similar fixes explained on daily.dev._ ## Similar posts on daily.dev - [VMware fixes command injection flaw in Aria Operations](https://daily.dev/posts/vmware-fixes-command-injection-flaw-in-aria-operations-ue2mrjloo) · CSO Online · 0 upvotes · 0 comments - [CVE-2025-25249: Remote Code Execution Vulnerability in FortiOS and FortiSwitchManager](https://daily.dev/posts/cve-2025-25249-remote-code-execution-vulnerability-in-fortios-and-fortiswitchmanager-joa3ypxd0) · Arctic Wolf · 0 upvotes · 0 comments - [MikroTrick: Inside the RouterOS Takeover Chain](https://daily.dev/posts/mikrotrick-inside-the-routeros-takeover-chain-zvgsi14sl) · Sliver C2 Documentation · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#firewall](https://daily.dev/tags/firewall) [View this post on daily.dev](https://daily.dev/posts/1-unread-message-uwku08yp4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"1 unread message","url":"https://daily.dev/posts/1-unread-message-uwku08yp4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/1-unread-message-uwku08yp4"},"datePublished":"2026-08-23T12:22:21.410Z","dateModified":"2026-08-23T12:53:44.075Z","description":"Bishop Fox disclosed six vulnerabilities in Arista NG Firewall version 17.4, including multiple arbitrary command injection flaws that allow root-level code...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cf1c3abae6d267583b1afafd5d9c0fb4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cf1c3abae6d267583b1afafd5d9c0fb4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/1-unread-message-uwku08yp4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,firewall","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"1 unread message"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/1-unread-message-uwku08yp4#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities were fixed in Arista NG Firewall 17.4.1?","acceptedAnswer":{"@type":"Answer","text":"Arista NG Firewall 17.4.1, released February 3, 2026, fixes six vulnerabilities discovered by Bishop Fox: CVE-2025-6978 and CVE-2026-25620 through CVE-2026-25624. These include arbitrary command injection in the diagnostics feature, a password encryption helper, the Captive Portal custom handler, an overly permissive RPC interface, insecure input validation in the Reports backup/restore feature, and a reflected XSS bug, several of which allowed root-level code execution. Track newly patched firewall CVEs like these on daily.dev before attackers exploit unpatched systems."}},{"@type":"Question","name":"How could the Arista NG Firewall XSS and RPC vulnerabilities be chained for remote code execution?","acceptedAnswer":{"@type":"Answer","text":"Reflected XSS on the /quarantine endpoint (CVE-2026-25624) could be combined with the overly permissive JSON-RPC interface (CVE-2026-25623) to achieve one-click remote code execution. Tricking a logged-in administrator into visiting a malicious URL triggered JSON-RPC calls in their browser, which accessed the exposed ExecManager interface to execute arbitrary commands as root on the appliance. Developers building admin interfaces can study real exploit chains like this one on daily.dev."}},{"@type":"Question","name":"How was the CVE-2026-25620 password encryption command injection vulnerability fixed in Arista NG Firewall?","acceptedAnswer":{"@type":"Answer","text":"The vulnerable PasswordUtil.getEncryptPassword method built a shell command by concatenating unsanitized user-supplied passwords into a string, allowing arbitrary command injection with root privileges. Version 17.4.1 fixes this by switching to Java's ProcessBuilder with tokenized input instead of raw shell string concatenation, preventing injected shell metacharacters from being interpreted as separate commands. Engineers hardening Java command execution code can find similar fixes explained on daily.dev."}}]} ```