Zerodayinitiative

CVE-2025-6978: Command Injection in Arista NG Firewall

First seen 5 Feb 2026, 23:27 UTC • Thezdi

•60.7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

CVE-2025-6978 is a command injection vulnerability in the Arista NG Firewall that allows for arbitrary code execution under the root user context. The vulnerability was discovered by Gereon Huppertz and reported through the TrendAI Zero Day Initiative program. A patch has been released to address this security issue.

How this analysis works

Attack Flow

8 entities, 9 inferred relationships (STIX 2.1).

Technique (2)

Zero-day Exploit
T1059 - Command and Scripting Interpreter

Organization (1)

TrendAI Research Services

Vulnerability (2)

CVE-2025-6798
CVE-2025-6978

Affected Platform (1)

Arista NG Firewall

Tool (2)

Network-troubleshooting.sh
Python

Relationships

Network-troubleshooting.sh exploits CVE-2025-6798
Network-troubleshooting.sh exploits CVE-2025-6978
Python exploits CVE-2025-6798
Python exploits CVE-2025-6978
CVE-2025-6798 targets Arista NG Firewall
CVE-2025-6978 targets Arista NG Firewall
Zero-day Exploit targets Arista NG Firewall
T1059 - Command and Scripting Interpreter targets Arista NG Firewall
CVE-2025-6798 related to TrendAI Research Services

Continue Reading

Critical Joomla JCE Vulnerability Under Active Exploitation Critical Zero-Day Vulnerability CVE-2026-20182 Exploited in Cisco SD-WAN Systems Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation Critical Unauthenticated RCE Vulnerability in LiteLLM Exploited in the Wild Critical Zero-Day Vulnerability in LiteSpeed cPanel Plugin Actively Exploited CVE-2026-47668: Unauthenticated RCE Vulnerability in DbGate

CVE-2025-6978: Command Injection in Arista NG Firewall

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading