CVE-2024-9132 is a high severity (CVSS 8.1) code injection issue in Arista NG Firewall. The record says an administrator is able to configure an insecure captive portal script. Arista tracks it as security advisory 0105, so read it for affected and fixed versions and apply the update it names.
What's affected
The record names Arista NG Firewall. Its description is one sentence: the administrator is able to configure an insecure captive portal script. The weakness class is code injection, and the CVSS vector says the attack is over the network with high complexity and no privileges, with high impact to confidentiality, integrity and availability.
The reference is Arista's security advisory 0105. We could not load that page automatically, so we cannot state affected version ranges or the fixed release here, and we will not guess them. The advisory is the place to confirm both.
The wording matters. The record describes a feature that lets a script be configured for the captive portal, which is the login or acceptance page shown to users joining a network. A configuration option that accepts script content needs careful limits, and the advisory should say what changed.
How to check if you're exposed
Because the details are in the vendor advisory, the check is to match your deployment against it.
- Sign in to the NG Firewall admin and note the installed version from the About or Status page.
- Open Arista security advisory 0105 and compare your version with the affected and fixed lists.
- Review the captive portal settings, and look at any custom script or page content configured. Ask who last changed it and when.
- Review the list of administrator accounts and recent configuration changes for anything unexpected.
If your firewall does not use the captive portal, the advisory should still be read to see whether the fix applies anyway.
What to do now
- Find every NG Firewall deployment and its version.
- Read Arista advisory 0105 and apply the update it names.
- Review captive portal configuration and any custom script content.
- Restrict administrator access to a management network and use strong, unique credentials with multi-factor sign in if available.
- Review admin accounts and the configuration change history.
- Re-check the advisory later in case the affected list is updated.
Why it matters
Some of the most serious issues in network appliances come from features that let an administrator supply content that the product then runs or serves. If an attacker gets the administrator role, or tricks an administrator, that content becomes a path to run code on the device that sits at the edge of the network.
The score is high but not critical because the vector says high attack complexity, and because the record frames the setup as an administrator action. Even so, a firewall is a high value device, so apply the vendor update and keep its admin interface off untrusted networks.
The weakness class is CWE-94: Code Injection. The CVSS vector in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 8.1. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Does this need admin access?
The record describes the issue as an administrator being able to configure an insecure script. Treat admin credentials on the device as a key defense.
Where do I find the fixed version?
In Arista's security advisory 0105, linked in the sources.
Sources
Last reviewed: 19 October 2026.
