CVE-2025-2767 is a critical (CVSS 9.6) cross-site scripting flaw in Arista NG Firewall. Unvalidated data in the User-Agent HTTP header can inject a script, and the record says an attacker can run code as root. Minimal user interaction is needed. Check the vendor advisory for the fixed release.
What's affected
The record names Arista NG Firewall as affected but does not list version numbers in the data we hold. The advisory was published through the Zero Day Initiative as ZDI-25-181 (tracked as ZDI-CAN-24407).
Because the record does not confirm a fixed version, check the ZDI advisory and Arista's release notes for the NG Firewall version that addresses it. Do not assume a version without reading them.
Severity in the record: critical, CVSS 9.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Weakness classes: CWE-79 (Cross-site scripting).
How to check if you're exposed
NG Firewall is an appliance and software product, so there is no package manager query.
- Open the NG Firewall administration interface and read the installed version from the dashboard or the about page.
- Compare it with the fixed version in the vendor and ZDI advisories.
- Note who can reach the administration interface and whether staff browse it from the same workstations they use for general web access.
- Look at the firewall's web logs for User-Agent values that contain markup or script characters.
What to do now
- Read ZDI-25-181 and the Arista release notes, find the fixed NG Firewall version, and schedule the upgrade.
- Restrict the administration interface to a management network or VPN, and do not expose it to the internet.
- Ask administrators to use a dedicated browser profile or workstation for the firewall console.
- Review logs for unusual User-Agent strings against the management interface and for unexpected administrative changes.
- If you suspect compromise, treat the firewall as untrusted: review configuration, rotate credentials and certificates, and consider rebuilding from a known good image.
- Record the appliance, version and decision in your asset register.
Why it matters
Cross-site scripting (CWE-79) happens when an application puts data it received into a page without encoding it, so that the browser treats it as active script. Here the data is the User-Agent header, which an attacker controls on every request and which is likely to be shown to an administrator in logs or status pages. The script then runs with the administrator's session.
The record's CVSS scope is changed (S:C), and it says code can run in the context of root. That jump from a browser flaw to command execution on the appliance is what makes this critical rather than a routine XSS. A firewall sits at the edge, so a compromise there gives an attacker a strong position. The user interaction requirement is the one thing that holds the score at 9.6 instead of higher.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
Is CVE-2025-2767 exploited in the wild?
The record does not flag it as known exploited, and the advisory we reviewed does not say so. Watch the advisory for updates.
What is the fixed version?
The record does not state one. Confirm it in the ZDI advisory ZDI-25-181 and Arista's release notes.
Sources
Last reviewed: 19 October 2026.
