PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-6980] Arista NextGen Firewall XSS to RCE Chain

bishopfox.com | blog | CVE-2025-6980 | #rce | #xss | #patching | #firewall | #arista | #cve-2025-6978
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox confirms all three Arista NGFW bugs (CVE-2025-6980/6979/6978) are exploitable and patches incomplete: XSS chains to RCE with victim interaction; disable the captive portal until fixes ship.
CVE
CVE-2025-6980
Published
Collected

Related coverage

research · bishopfox.com
Deep Dive into Arista NG Firewall Vulnerabilities
Bishop Fox found six vulnerabilities in Arista NG Firewall 17.4, including command injections that yield root access and a chain to RCE via a malicious URL; organizations should update to 17.4.1.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
blog · bishopfox.com
SonicWall Sonicos Versions 7.1.x and 8.0.x
Bishop Fox found an unauthenticated DoS in SonicWall's SSL VPN (CVE-2025-32818): crafted API requests crash and reboot NSv appliances, taking the VPN offline. Patch to 7.2.0/8.0.1 or disable it.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
blog · hackerone.com
Top Firewall Misconfigurations that Lead to Easy Exploitations by Attackers
Part 2 of the AWS security series reviews VPC, network ACLs, security groups, and NAT gateways, showing how common firewall misconfigurations in the cloud lead to easy exploitation by attackers.
blog · aikido.dev
How to patch PHP2Shell with free Aikido Images
PHP2Shell is a pair of critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and either one can let an unauthenticated attacker run code on a server that handles PHP requests. Cloudflare reports that exploitation has started.
Back