# CVE-2025-6978: Authenticated Diagnostics Command Injection Leading to Root RCE in Arista NG Firewall

> A command injection vulnerability in the runTroubleshooting() JSON-RPC diagnostics method of Arista NG Firewall (formerly Untangle) allows an authenticated administrator to execute arbitrary OS commands as root by injecting backticks and unfiltered shell metacharacters via the HOST or URL parameters. Discovered by Gereon Huppertz and disclosed via ZDI (ZDI-CAN-24407); patched in Arista Security Advisory 0123 (upgrade to v17.4+), though researchers report the patch was incomplete and additional attack vectors within the same method remain unaddressed.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1550
- **ID:** TL-2026-1550
- **Severity:** HIGH (CVSS 7.2)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-6978, CVE-2025-6979, CVE-2025-6980

## Description

CVE-2025-6978 is an OS command injection vulnerability (CWE-78) in the diagnostics subsystem of Arista Next Generation Firewall (NGFW), the product line formerly known as Untangle NG Firewall, acquired by Arista Networks / Edge Threat Management. The flaw resides in the runTroubleshooting() method of the NetworkManagerImpl Java class, which is exposed to the administrative web UI via a JSON-RPC endpoint at /admin/JSON-RPC. When an administrator invokes network diagnostic tooling (e.g., ping/traceroute-style connectivity tests) through the UI, the HOST and URL parameters supplied in the JSON-RPC request body are passed largely unvalidated into environment variables consumed by a backend shell script, network-troubleshooting.sh, which uses eval to execute the assembled command line.

Arista's input filtering for this method blocks a common set of shell metacharacters -- semicolons, ampersands, pipes, redirection operators, and $() command substitution -- but omits the backtick (`) character entirely. An authenticated attacker holding administrative UI credentials can therefore embed a backtick-delimited command substitution inside the HOST or URL parameter (e.g., `` `id > /tmp/poc` ``) and have it evaluated by the shell with root privileges, since the underlying diagnostics service runs as root on the NGFW appliance. Published proof-of-concept technique chains this primitive to write and execute a Python script on the target filesystem, achieving full arbitrary code execution without needing any of the explicitly blocked characters.

The vulnerability was reported to Arista through Trend Micro's Zero Day Initiative (ZDI) program by researcher Gereon Huppertz (tracked internally as ZDI-CAN-24407) and disclosed publicly via ZDI's blog on 2026-02-04, alongside two related NGFW findings patched in the same advisory: CVE-2025-6979 (reflected XSS in the Captive Portal, misclassified in early reporting as an authentication bypass) and CVE-2025-6980 (Captive Portal information disclosure via an Apache mod_python.publisher misconfiguration that exposed internal script functions, leaking VPN private keys and credentials). Bishop Fox's independent research demonstrates these findings can be chained: the reflected XSS in the Captive Portal (CVE-2025-6979) can be weaponized to deliver a one-click attack against an authenticated administrator who visits a crafted URL, using the victim's own session to trigger the CVE-2025-6978 command injection and achieve remote code execution without the attacker ever needing standalone admin credentials -- materially raising the real-world severity above the CVSS vector's PR:H (privileges required: high) assumption.

Arista shipped Security Advisory 0123 fixing all three CVEs in NGFW version 17.4, with the primary mitigation for CVE-2025-6978 being upgrade to 17.4+; interim guidance is to restrict administrative UI access to trusted networks/personnel only, since the flaw requires reaching the /admin/JSON-RPC endpoint. Independent researcher testing (Bishop Fox, and corroborated by third-party trackers) reports the 17.4 patch for CVE-2025-6978 was incomplete: the runTroubleshooting() handler still performs insufficient sanitization in the general case, and additional undisclosed exploitation vectors within the same diagnostics code path were reported to Arista as of the ZDI blog's publication, meaning organizations should not treat the upgrade alone as fully closing the diagnostics attack surface. There is no evidence of in-the-wild exploitation; CVE-2025-6978 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing, and both ZDI and Arista characterize it as researcher-disclosed, PoC-grade.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1489 Service Stop
- T1587 Develop Capabilities
- T1595 Active Scanning

## Sources

- [Zero Day Initiative -- CVE-2025-6978: Arbitrary Code Execution in the Arista NG Firewall](https://www.thezdi.com/blog/2026/2/4/cve-2025-6978-arbitrary-code-execution-in-the-arista-ng-firewall)
- [ZDI-25-181](https://www.zerodayinitiative.com/advisories/ZDI-25-181/)
- [Arista Security Advisory 0123](https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123)
- [CVE-2025-6978 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-6978)
- [Arista Firewall XSS to RCE Chain -- Bishop Fox](https://bishopfox.com/blog/arista-nextgen-firewall-xss-to-rce-chain)
- [CVE-2025-6978 -- PT Security Vulnerability Database (PT-2025-43545)](https://dbugs.ptsecurity.com/vulnerability/PT-2025-43545)
- [CVE-2025-6980 -- Vulnerability-Lookup](https://cve.circl.lu/vuln/cve-2025-6980)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1550