CVE-2026-102165: Arista Wi-Fi Access Point RCE Vulnerability

CVE-2026-102165 Overview

CVE-2026-102165 affects Arista Wi-Fi access points running a vulnerable version of the capture service. An unauthenticated attacker with adjacent network access can send a crafted packet to the capture service, triggering a stack-based buffer overflow [CWE-121]. Successful exploitation causes the service to crash or, in some configurations, enables remote code execution. The vulnerability requires the capture service to run in a non-default streaming mode, which limits exposure to deployments that have explicitly enabled this feature. Arista disclosed the issue in Security Advisory #0198.

Critical Impact

Unauthenticated adjacent attackers can crash the capture service or achieve remote code execution on affected Arista Wi-Fi access points when non-default streaming mode is enabled.

Affected Products

• Arista Wi-Fi access points running the vulnerable capture service
• Deployments with non-default streaming mode enabled on the capture service
• Refer to Arista Security Advisory #0198 for the full list of affected models and software trains

Discovery Timeline

• 2026-10-06 - CVE-2026-102165 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102165

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in the capture service that runs on Arista Wi-Fi access points. The capture service accepts packets over the network for traffic capture and streaming operations. When the service is configured in a non-default streaming mode, it processes incoming packets using a fixed-size stack buffer without adequate bounds checking. A crafted packet containing an oversized field overflows the buffer, corrupting adjacent stack memory including saved return addresses and local variables.

Because the capture service does not require authentication for incoming packets on the affected interface, any attacker with adjacent network reachability can trigger the condition. The immediate consequence is a service crash resulting in loss of capture functionality. In scenarios where stack protections can be bypassed or are not applied to the overwritten memory, the overflow can be leveraged to redirect execution flow and run attacker-supplied code in the context of the capture service process.

Root Cause

The root cause is missing or insufficient length validation when the capture service parses packets in streaming mode. Attacker-controlled size values are used to copy data into a fixed-size stack buffer, allowing memory beyond the buffer to be written.

Attack Vector

The attack vector is adjacent network. The attacker must reach the capture service over a network path that includes the access point and must send a single crafted packet matching the streaming protocol format. User interaction is not required. Exploitation is gated by the target running the non-default streaming mode configuration. See the Arista Security Advisory #0198 for protocol-level details.

No verified proof-of-concept code is publicly available. The vulnerability is described in prose because no sanitized exploitation sample has been released by the vendor or researchers.

Detection Methods for CVE-2026-102165

Indicators of Compromise

• Unexpected crashes, restarts, or core dumps of the capture service on Arista Wi-Fi access points
• Gaps or truncation in packet capture streams delivered to collectors
• Inbound traffic to the capture service port from untrusted or unmanaged client subnets

Detection Strategies

• Enable centralized syslog collection from Arista access points and alert on capture service process termination or restart events
• Baseline the set of hosts permitted to initiate capture-streaming sessions and alert on unknown sources
• Inspect capture streaming traffic at the network boundary for oversized or malformed length fields

Monitoring Recommendations

• Forward access point logs and configuration state into a centralized data lake for correlation with wireless and network telemetry
• Track changes to capture service configuration, specifically transitions to non-default streaming mode
• Monitor adjacent network segments for anomalous unicast flows targeting management-plane services on access points

How to Mitigate CVE-2026-102165

Immediate Actions Required

• Inventory Arista Wi-Fi access points and identify units with the capture service enabled in non-default streaming mode
• Disable non-default streaming mode on the capture service where it is not operationally required
• Restrict network reachability to the capture service using access control lists or management VLAN segmentation
• Apply the fixed software release referenced in Arista Security Advisory #0198 as soon as it is validated in your environment

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0198. Review the advisory for the specific fixed software trains that correspond to your access point model and current firmware version. Apply the recommended upgrade path through standard change management.

Workarounds

• Revert the capture service to its default (non-streaming) mode until patched firmware is deployed
• Place the capture service behind an access control list that permits only known capture collectors
• Isolate access point management interfaces on a dedicated VLAN not reachable from client wireless networks

# Example: restrict capture service exposure via management ACL
# Replace <collector_ip> with your authorized packet capture collector
# and <mgmt_iface> with the management interface on the access point
ip access-list CAPTURE-SERVICE-ACL
  permit tcp host <collector_ip> any eq <capture_port>
  deny   tcp any any eq <capture_port>
  permit ip  any any

interface <mgmt_iface>
  ip access-group CAPTURE-SERVICE-ACL in