This vulnerability (CWE-78) in Arista Networks' NGFW version 17.4.0 arises from insecure input validation in the Reports application infrastructure, allowing an attacker with high privileges to inject OS commands. The CVSS 3.1 base score is 6.0, indicating medium severity with network attack vector, low attack complexity, required high privileges, no user interaction, and impacts confidentiality, integrity, and availability to varying degrees. No patch or official remediation level has been disclosed, and it is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with high privileges to execute arbitrary OS commands, potentially leading to partial confidentiality loss, limited integrity compromise, and limited availability impact on the affected system. The vulnerability is limited to version 17.4.0 and does not affect earlier releases. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor Arista Networks advisories for updates. Until a patch is available, restricting access to the affected version and limiting privileged user actions may reduce risk.