CVE-2026-102164: Security Advisory 0196
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.4.0M-12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.1.1F-61
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Arista access points only when they are configured with both VXLAN tunnelling and L2-proxy, a configuration described as specific to the VESPA use case. A wireless client must be associated with the tunnelled SSID.
What access does an attacker need?
An attacker does not need prior privileges or user interaction, but must be able to associate a wireless client with the affected tunnelled SSID and send a crafted packet.
What is the expected impact if exploitation succeeds?
Successful exploitation can cause the access point to disclose memory contents in network traffic. The available information states that it does not provide a write primitive or remote code execution.