This vulnerability involves improper neutralization of special elements used in OS commands (CWE-78) within the browser management pipeline of Arista Edge Threat Management - Arista NGFW. It allows authenticated administrators to execute underlying terminal script code, potentially leading to unauthorized command execution. The CVSS 3.1 base score is 6.0, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could allow an authenticated administrator to execute arbitrary terminal commands on the underlying system, potentially compromising confidentiality and causing limited integrity and availability impacts. However, exploitation requires high privileges (authenticated administrator access). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for unusual administrative activity. Do not assume the vulnerability is mitigated without vendor confirmation.