CVE-2026-102165: Security Advisory 0198
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Arista Wi-Fi access pointsto a version that resolves this vulnerability.Fixed in 21.4.0M-12 - Upgrade
Upgrade
Arista Wi-Fi access pointsto a version that resolves this vulnerability.Fixed in 22.1.1F-61
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only affected Arista Wi-Fi access points with the capture service reachable by an attacker and the uncommonly used, non-default streaming mode enabled are described as exposed.
What does an attacker need to exploit it?
The attacker does not need authentication or user interaction, but must have network access to the capture service and be able to send a crafted packet. Exploitation has high attack complexity.
What is the impact of successful exploitation?
A crafted packet can crash the capture service and may potentially allow remote code execution, with high impact to confidentiality, integrity, and availability.
What can be done if patching is not immediately possible?
Disable the affected non-default streaming mode and restrict network access to the capture service to reduce exposure.