Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
References
| Link | Resource |
|---|---|
| https://https://www.arista.com/en/support/advisories-notices/security-advisory/19038-security-advisory-0093 | Vendor Advisory Broken Link |
| https://https://www.arista.com/en/support/advisories-notices/security-advisory/19038-security-advisory-0093 | Vendor Advisory Broken Link |
Configurations
History
22 Oct 2025, 13:49
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Arista ng Firewall
Arista |
|
| References | () https://https://www.arista.com/en/support/advisories-notices/security-advisory/19038-security-advisory-0093 - Vendor Advisory, Broken Link | |
| CPE | cpe:2.3:a:arista:ng_firewall:*:*:*:*:*:*:*:* |
Information
Published : 2024-03-04 20:15
Updated : 2025-10-22 13:49
NVD link : CVE-2024-27889
Mitre link : CVE-2024-27889
CVE.ORG link : CVE-2024-27889
JSON object : View
Products Affected
arista
- ng_firewall
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')