{"id":"CVE-2025-6979","state":"PUBLISHED","title":"Captive Portal can allow authentication bypass","description":"Captive Portal can allow authentication bypass","publishedAt":"2025-10-23T18:46:37.557Z","updatedAt":"2025-10-23T18:59:32.658Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"Arista"},"assigner":"Arista","products":["Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall"],"affected":[{"vendor":"Arista Networks","product":"Arista Edge Threat Management - Arista Next Generation Firewall","defaultStatus":"unaffected","versions":[{"version":"0.0","status":"affected","lessThanOrEqual":"17.3.1","versionType":"custom"}]}],"references":["https://https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/6xxx/CVE-2025-6979.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-6979","state":"PUBLISHED","datePublished":"2025-10-23T18:46:37.557Z","dateUpdated":"2025-10-23T18:59:32.658Z","assignerShortName":"Arista","assignerOrgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","dateReserved":"2025-07-01T16:53:03.559Z"},"containers":{"cna":{"title":"Captive Portal can allow authentication bypass","descriptions":[{"lang":"en","value":"Captive Portal can allow authentication bypass"}],"affected":[{"vendor":"Arista Networks","product":"Arista Edge Threat Management - Arista Next Generation Firewall","defaultStatus":"unaffected","versions":[{"version":"0.0","status":"affected","lessThanOrEqual":"17.3.1","versionType":"custom"}]}],"references":[{"url":"https://https://www.arista.com/en/support/advisories-notices/security-advisory/22535-security-advisory-0123"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Arista","orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","dateUpdated":"2025-10-23T18:46:37.557Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

CVE-2025-6979 (ZDI-CAN-27007) - Captive Portal can allow authentication bypass

Required Configuration for Exploitation
 
If the Captive Portal application is installed and enabled, the systems are vulnerable.
 
To access this information:
  1. As the NGFW administrator, log into the UI and navigate to the Captive Portal application.
  2. If the Captive Portal application is not installed, the system is not vulnerable.
  3. If Captive Portal is not enabled, the system is not vulnerable.

\"Captive

Indicators of Compromise

No evidence of compromise exists.

"}],"value":"CVE-2025-6979 (ZDI-CAN-27007) - Captive Portal can allow authentication bypassRequired Configuration for Exploitation\n\n \n\nIf the Captive Portal application is installed and enabled, the systems are vulnerable.\n\n \n\nTo access this information:\n\n * As the NGFW administrator, log into the UI and navigate to the Captive Portal application.\n * If the Captive Portal application is not installed, the system is not vulnerable.\n * If Captive Portal is not enabled, the system is not vulnerable.\n\n\nIndicators of CompromiseNo evidence of compromise exists."}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:arista_networks:arista_edge_threat_management_-_arista_next_generation_firewall:*:*:*:*:*:*:*:*","versionEndIncluding":"17.3.1","versionStartIncluding":"0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Arista would like to acknowledge and thank Gereon Huppertz working with Trend Zero Day Initiative for reporting CVE-2025-6979"}],"datePublic":"2025-10-21T15:00:00.000Z","impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

The recommended resolution is to upgrade to the version indicated below at your earliest convenience.

"}],"value":"The recommended resolution is to upgrade to the version indicated below at your earliest convenience.\n\n * 17.4 Upgrade"}],"source":{"advisory":"123","defect":["NGFW-15196"],"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Mitigation

Disable Captive Portal.

As the NGFW administrator, log into the UI and navigate to the Captive Portal application.
  1. If the Captive Portal application is not installed, the system is not vulnerable.
  2. If Captive Portal is not enabled, the system is not vulnerable.
  3. Move the Enabled slider to disabled.
  4. Click Save
  5. Disable Captive Portal.

"}],"value":"MitigationDisable Captive Portal.\n\nAs the NGFW administrator, log into the UI and navigate to the Captive Portal application.\n\n * If the Captive Portal application is not installed, the system is not vulnerable.\n * If Captive Portal is not enabled, the system is not vulnerable.\n * Move the Enabled slider to disabled.\n * Click Save\n * Disable Captive Portal."}],"x_generator":{"engine":"Vulnogram 0.4.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-23T18:59:26.677141Z","id":"CVE-2025-6979","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-23T18:59:32.658Z"}}]}}}