CVE-2024-27889 SQL injection in Arista Edge Threat Management - Arista NG Firewall (NGFW)
A user with report access can exploit SQL injection to execute OS commands with elevated privileges on Arista NG Firewall.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27889?
CVE-2024-27889 is a high-severity SQL injection vulnerability in Arista Edge Threat Management - Arista NG Firewall (NGFW), published on 4 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
Weakness: CWE-89
Which versions are affected by CVE-2024-27889?
It affects 1 product.
Products include Arista Ng Firewall.
How do I fix CVE-2024-27889?
No fix has been published for CVE-2024-27889 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-27889 being exploited?
There is no known exploitation of CVE-2024-27889 in the wild and no public exploit code.
Other vulnerabilities in Arista Edge Threat Management - Arista NG Firewall (NGFW)
- CVE-2025-2767 Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability
- CVE-2024-9188 Specially constructed queries cause cross platform scripting leaking administrator tokens
- CVE-2024-47519 Backup uploads to ETM subject to man-in-the-middle interception
- CVE-2024-9134 SQL injection in Arista Edge Threat Management
- CVE-2024-12832 Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability
Sources
Also known as GHSA-9w96-264r-8f55.