CVE-2026-102162: Arista Wi-Fi Access Point DoS Vulnerability

CVE-2026-102162 Overview

CVE-2026-102162 is a stack-based buffer overflow [CWE-121] in the wireless gateway service of Arista Wi-Fi access points. The flaw affects access points with captive portal or application firewall enabled on at least one SSID. An unauthenticated network-adjacent attacker can send a crafted packet to trigger the overflow. Successful exploitation causes denial of service or arbitrary code execution on the device. The wireless gateway service automatically restarts after a crash, which lets attackers retry exploitation without manual intervention.

Critical Impact
Network-adjacent attackers can crash or take control of Arista Wi-Fi access points without authentication, with automatic service restart enabling repeated exploitation attempts.

Affected Products

Arista Wi-Fi access points with captive portal enabled on at least one SSID
Arista Wi-Fi access points with application firewall enabled on at least one SSID
Arista wireless gateway service (vulnerable component)

Discovery Timeline

2026-10-06 - CVE-2026-102162 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102162

Vulnerability Analysis

The vulnerability resides in the wireless gateway service that handles traffic for SSIDs configured with captive portal or application firewall features. Processing of a crafted packet writes attacker-controlled data beyond the bounds of a stack buffer. This classic stack overflow condition [CWE-121] corrupts adjacent stack memory, including saved return addresses and frame pointers.

An attacker on the adjacent wireless network does not need credentials or user interaction. The crash of the wireless gateway service by itself produces a denial-of-service condition that disrupts captive portal authentication and application firewall enforcement. Where the attacker can control stack contents sufficiently, the flaw escalates to arbitrary code execution on the access point.

The service's automatic restart behavior removes a common barrier to exploitation. Attackers can iterate on payloads against the same device repeatedly, improving reliability of code execution attempts or sustaining a denial-of-service condition indefinitely.

Root Cause

The root cause is missing or inadequate bounds checking when the wireless gateway service parses attacker-supplied input from a network packet. Input length is not validated against the destination stack buffer size before the copy operation, producing a stack-based buffer overflow.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must be within range of the wireless network or on the same Layer 2 broadcast domain. No authentication, privileges, or user interaction are required. The attacker sends one or more crafted packets targeting the wireless gateway service on an SSID with captive portal or application firewall enabled.

The vulnerability is described in prose only. Arista has not published proof-of-concept code. See the Arista Security Advisory #0193 for vendor-supplied technical details.

Detection Methods for CVE-2026-102162

Indicators of Compromise

Unexpected restarts of the wireless gateway service on Arista Wi-Fi access points
Access point crash dumps or core files referencing stack corruption in the wireless gateway process
Captive portal or application firewall functionality intermittently failing on affected SSIDs
Anomalous or malformed packets directed at access points from wireless clients prior to service crashes

Detection Strategies

Monitor access point syslog and SNMP traps for repeated wireless gateway service restarts
Correlate client association events with service crash events to identify the originating device MAC
Baseline normal packet patterns on captive portal and application firewall SSIDs and alert on deviations

Monitoring Recommendations

Forward Arista access point logs to a centralized SIEM for crash and restart event correlation
Enable wireless intrusion detection to flag unauthorized or anomalous client behavior near affected SSIDs
Track EPSS trend data for CVE-2026-102162 and reprioritize patching if the score increases

How to Mitigate CVE-2026-102162

Immediate Actions Required

Review the Arista Security Advisory #0193 and identify affected access point models and firmware versions in your environment
Apply the vendor-supplied fixed firmware to all affected Arista Wi-Fi access points
If patching cannot occur immediately, disable captive portal and application firewall on affected SSIDs where operationally feasible
Restrict wireless coverage areas to trusted zones to reduce the attack surface for adjacent-network attackers

Patch Information

Arista has published Security Advisory #0193 with remediation guidance and fixed software versions. Consult the advisory for the complete list of affected and fixed releases, and schedule upgrades following your change management process.

Workarounds

Disable the captive portal feature on all SSIDs where it is not strictly required
Disable the application firewall feature on affected SSIDs until patched firmware is deployed
Segment management and guest networks to limit which clients can reach the wireless gateway service
Increase monitoring of wireless gateway service health to detect exploitation attempts quickly

bash

# Example: identify SSIDs with captive portal or application firewall enabled
# Consult Arista CLI documentation for the exact commands for your platform
show wireless ssid detail | include "Captive Portal|Application Firewall"