This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the administrative dashboard of Arista Edge Threat Management - Arista NGFW. Specifically, unvalidated user-supplied variables are echoed back to administrative profiles, which can facilitate cross-site scripting attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, unchanged scope, with high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could allow an attacker with administrative privileges to execute arbitrary scripts in the context of the administrative web interface. This may lead to disclosure of sensitive information (high confidentiality impact), limited integrity impact, and some availability impact. However, exploitation requires high privileges and user interaction, limiting the ease of attack. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with input handling in the affected interface and restrict administrative access to trusted users only. Monitor vendor communications for updates on patches or mitigations.