CVE-2025-6978

Published Oct 23, 2025

Last updated 3 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6978 describes a command injection vulnerability found in the Arista NG Firewall. This flaw stems from insufficient validation of user-supplied data within the diagnostics component of the firewall. A remote, authenticated attacker can exploit this vulnerability by sending specially crafted requests to the target server. Successful exploitation could enable the attacker to execute arbitrary commands with the privileges of the root user. The vulnerability is categorized under CWE-78, indicating an "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')".

Description: Diagnostics command injection vulnerability
Source: psirt@arista.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@arista.com: CWE-78

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

References