CVE-2026-102162: Security Advisory 0193
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arista Wi-Fi access pointsto a version that resolves this vulnerability.Fixed in 21.4.0M-12 - Upgrade
Upgrade
Arista Wi-Fi access pointsto a version that resolves this vulnerability.Fixed in 22.1.1F-61
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected Arista Wi-Fi access points are exposed when captive portal or application firewall is enabled on at least one SSID. The issue is in the wireless gateway service.
What access does an attacker need?
An attacker must be network-adjacent to the affected access point. No authentication, privileges, or user interaction are required.
What could exploitation achieve?
A crafted packet can trigger a stack overflow in the wireless gateway service, causing denial of service or potentially allowing arbitrary code execution on the device.
Can exploitation be repeated after a crash?
Yes. The wireless gateway service automatically restarts after a crash, allowing repeated exploitation attempts.