The recommended resolution is to upgrade to the version indicated below at your earliest convenience.
* 17.4 Upgrade
Configurations
1) CVE-2025-6980 (ZDI-CAN-27006) - Captive Portal can expose sensitive informationRequired Configuration for Exploitation
If the Captive Portal application is installed and enabled, the systems are vulnerable.
To access this information:
* As the NGFW administrator, log into the UI and navigate to the Captive Portal application.
* If the Captive Portal application is not installed, the system is not vulnerable.
* If Captive Portal is not enabled, the system is not vulnerable.
The above shows Captive Portal as enabled.
Indicators of CompromiseNo evidence of compromise exists.
MitigationDisable Captive Portal.
As the NGFW administrator, log into the UI and navigate to the Captive Portal application.
* If the Captive Portal application is not installed, the system is not vulnerable.
* If Captive Portal is not enabled, the system is not vulnerable.
* Move the Enabled slider to disabled.
* Click Save
* Disable Captive Portal.
2) CVE-2025-6979 (ZDI-CAN-27007) - Captive Portal can allow authentication bypassRequired Configuration for Exploitation
If the Captive Portal application is installed and enabled, the systems are vulnerable.
To access this information:
* As the NGFW administrator, log into the UI and navigate to the Captive Portal application.
* If the Captive Portal application is not installed, the system is not vulnerable.
* If Captive Portal is not enabled, the system is not vulnerable.
Indicators of CompromiseNo evidence of compromise exists.
MitigationDisable Captive Portal.
As the NGFW administrator, log into the UI and navigate to the Captive Portal application.
* If the Captive Portal application is not installed, the system is not vulnerable.
* If Captive Portal is not enabled, the system is not vulnerable.
* Move the Enabled slider to disabled.
* Click Save
* Disable Captive Portal.
3) CVE-2025-6978 (ZDI-CAN-27310) - Diagnostics command injection vulnerabilityRequired Configuration for Exploitation
* A successful attack requires administrative access to the NGFW UI.
Workarounds
Do not allow non-authorized administrative access or access to the administrative browser.
Exploits
Credits
finder
Arista would like to acknowledge and thank Gereon Huppertz working with Trend Zero Day Initiative for reporting CVE-2025-6980