Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-6980] Arista NextGen Firewall XSS to RCE Chain

bishopfox.com | blog | CVE-2025-6980 | #rce | #xss | #patching | #firewall | #arista | #cve-2025-6978

Summary

Bishop Fox confirms all three Arista NGFW bugs (CVE-2025-6980/6979/6978) are exploitable and patches incomplete: XSS chains to RCE with victim interaction; disable the captive portal until fixes ship.
Published
Collected

original ↗

Related coverage

  1. Deep Dive into Arista NG Firewall Vulnerabilities (bishopfox.com)
  2. StyleSmuggler fix: patch the Magento and Adobe Commerce RCE (aikido.dev)
  3. XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638) (pwn.ai)
  4. SonicWall Sonicos Versions 7.1.x and 8.0.x (bishopfox.com)
  5. CA Single Sign-On Software Update: Stay Secure (bishopfox.com)
  6. 1Password's AI patching benchmark is misleading (blog.trailofbits.com)

back