CVE-2026-102163: Arista Access Point WIPS RCE Vulnerability

CVE-2026-102163 Overview

CVE-2026-102163 affects Arista access points running the Wireless Intrusion Prevention System (WIPS). An unauthenticated attacker within radio frequency (RF) proximity can send a crafted wireless frame to crash the sensor service. A successful crash disables WIPS monitoring on the targeted access point. The vendor advisory indicates the flaw may also enable remote code execution on the device. No wireless association or authentication to the network is required for exploitation.

Critical Impact

An adjacent attacker can silently disable WIPS monitoring or potentially execute code on affected Arista access points by transmitting a single crafted RF frame.

Affected Products

• Arista access points with Wireless Intrusion Prevention System (WIPS) enabled
• Refer to the Arista Security Advisory #0195 for the authoritative list of affected models and firmware versions

Discovery Timeline

• 2026-10-06 - CVE-2026-102163 published to the National Vulnerability Database
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102163

Vulnerability Analysis

The vulnerability resides in the WIPS sensor service that processes wireless frames observed over the air. Processing a crafted frame triggers an out-of-bounds write condition classified under [CWE-787]. The attack vector is adjacent network, meaning the adversary must be within radio range of the sensor but does not need to associate with any SSID. Successful exploitation terminates the sensor process, which removes the access point's ability to detect rogue devices, deauthentication attacks, and other wireless threats. The vendor advisory also notes a potential path to remote code execution on the access point itself.

Root Cause

The sensor service writes attacker-controlled data outside the bounds of an allocated memory buffer when parsing a malformed wireless management frame. Out-of-bounds writes can corrupt adjacent memory structures, overwrite function pointers, or destabilize the service, leading to a crash or arbitrary code execution depending on heap state and mitigations.

Attack Vector

Exploitation requires only RF proximity to the target access point. The attacker transmits a crafted 802.11 frame that is captured and parsed by the WIPS sensor. Because WIPS passively inspects frames regardless of association state, no credentials, SSID knowledge, or client authentication is required. The attacker can repeat the frame to keep the sensor offline, blinding the organization to concurrent wireless attacks.

No verified public proof-of-concept code is available. See the Arista Security Advisory #0195 for vendor-provided technical details.

Detection Methods for CVE-2026-102163

Indicators of Compromise

• Unexpected termination or repeated restarts of the WIPS sensor service on Arista access points
• Gaps in WIPS telemetry or alerting from specific access points without a corresponding maintenance window
• Access point management logs showing sensor process crashes or watchdog-triggered restarts

Detection Strategies

• Monitor controller and access point syslog streams for sensor service crash messages and process restart events
• Correlate loss of WIPS alerts from a given access point with the appearance of anomalous management frames in nearby sensors still operational
• Alert on unusual 802.11 management frame patterns captured by neighboring sensors covering the same RF area

Monitoring Recommendations

• Forward access point and wireless controller logs to a centralized SIEM for continuous WIPS service health monitoring
• Baseline normal WIPS event volume per access point and alert on sudden drops
• Deploy overlapping sensor coverage so a single disabled access point does not create a blind spot

How to Mitigate CVE-2026-102163

Immediate Actions Required

• Review the Arista Security Advisory #0195 and identify affected access point models and firmware in your environment
• Apply vendor-provided fixed firmware to all affected access points as soon as change windows allow
• Prioritize patching for access points deployed in high-risk or publicly accessible RF environments

Patch Information

Arista has published remediation guidance in Security Advisory #0195. Administrators should consult the advisory for the fixed firmware versions and upgrade procedures that address CVE-2026-102163.

Workarounds

• If immediate patching is not feasible, follow any temporary mitigations outlined in the Arista advisory
• Increase physical and RF monitoring around affected access points to detect anomalous transmitters
• Ensure overlapping WIPS sensor coverage so one disabled sensor does not create a monitoring gap

# Example: verify access point firmware version against the fixed release
# (replace with the version listed in Arista Security Advisory #0195)
show version
show wireless access-point summary