CVE-2025-2767

Summary

CVE-2025-2767 is a User-Agent Cross-Site Scripting (XSS) vulnerability in Arista NG Firewall. This issue permits remote code execution, allowing attackers to inject arbitrary scripts into the system by exploiting the lack of proper validation of user-supplied data, specifically the User-Agent HTTP header. Minimal user interaction is required to trigger the vulnerability. An attacker can leverage this flaw to execute code with root privileges. (ZDI-CAN-24407) In simpler terms, Arista NG Firewall is susceptible to a CVE-2025-2767 vulnerability, where an attacker can inject and execute arbitrary code through a User-Agent XSS flaw. Without significant user engagement, the attacker can run scripts as the root user. (ZDI-CAN-24407) CVE-2025-2767 is a critical Arista NG Firewall flaw. An attacker can exploit this User-Agent Cross-Site Scripting (XSS) vulnerability to execute arbitrary code on affected installations. Minimal user interaction is necessary, and the attacker can carry out the attack by injecting a script into the User-Agent HTTP header. The exploited script runs with root privileges. (ZDI-CAN-24407) Arista NG Firewall is vulnerable to CVE-2025-2767, a User-Agent XSS vulnerability. Attackers can inject and execute arbitrary code on affected installations by exploiting the lack of proper data validation, specifically for the User-Agent HTTP header. The vulnerability allows attackers to run scripts with root privileges with minimal user interaction. (ZDI-CAN-24407) CVE-2025-2767 is a severe vulnerability in Arista NG Firewall. Attackers can exploit the User-Agent Cross-Site Scripting (XSS) flaw to run arbitrary scripts on affected installations with root privileges. The vulnerability is triggered by the lack of proper validation of user-supplied data in the User-Agent HTTP header, requiring minimal user interaction to exploit. (ZDI-CAN-24407)

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.