CVE-2026-102167: Arista Wi-Fi Access Point RCE Vulnerability

CVE-2026-102167 Overview

CVE-2026-102167 is a memory corruption vulnerability affecting Arista Wi-Fi access points. The flaw resides in the access point's wired uplink network endpoints and is classified under [CWE-121] as a stack-based buffer overflow. An unauthenticated attacker positioned on the same network segment as the access point's wired uplink can crash the sensor service or potentially achieve remote code execution. The vulnerability requires adjacent network access rather than remote internet-based exploitation. Arista disclosed the issue in Security Advisory #0197.

Critical Impact
Unauthenticated attackers on the same network segment can trigger memory corruption to crash the sensor service or achieve remote code execution on affected Arista Wi-Fi access points.

Affected Products

Arista Wi-Fi access points (specific models listed in Arista Security Advisory #0197)
Access point sensor service exposed on wired uplink network endpoints
Deployments where the wired uplink segment is reachable by untrusted hosts

Discovery Timeline

2026-10-06 - CVE-2026-102167 published to the National Vulnerability Database (NVD)
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102167

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in the network endpoints exposed by the sensor service on the access point's wired uplink interface. Processing of attacker-controlled input on these endpoints leads to memory corruption on the stack. Corruption of stack memory can overwrite control data such as saved return addresses, enabling either a service crash or code execution in the context of the sensor process. Because the vulnerable endpoints do not require authentication, any host that can reach the wired uplink can trigger the flaw.

Root Cause

The root cause is insufficient bounds checking when the sensor service copies network-supplied data into a fixed-size stack buffer. The vulnerable code path handles traffic received on the wired uplink endpoints. When input exceeds the expected length, the write operation extends beyond the buffer and overwrites adjacent stack frames. Arista Security Advisory #0197 provides the authoritative technical description.

Attack Vector

Exploitation requires adjacent network access. The attacker must be on the same Layer 2 segment as the access point's wired uplink port. From that position, the attacker sends crafted traffic to the exposed endpoint without providing credentials. A successful write past the buffer boundary crashes the sensor service, resulting in denial of service. A tailored payload that corrupts control structures on the stack can transition the condition into remote code execution.

No verified public proof-of-concept code is available at the time of writing. Refer to the Arista Security Advisory #0197 for vendor-provided technical details.

Detection Methods for CVE-2026-102167

Indicators of Compromise

Unexpected crashes, restarts, or watchdog resets of the sensor service on Arista Wi-Fi access points
Core dumps or stack trace entries referencing the wired uplink network endpoint handlers
Loss of management or telemetry visibility from an access point immediately after unusual inbound traffic on the uplink
Anomalous packets with oversized fields targeting non-standard service ports on access point uplink interfaces

Detection Strategies

Monitor access point syslog and SNMP traps for sensor service termination, segmentation faults, or repeated process restarts
Capture packet flows on wired uplink switch ports for abnormally large payloads directed at access point management endpoints
Correlate access point reboots with originating source addresses on the same Layer 2 segment
Baseline normal management traffic volume and alert on deviations from untrusted hosts

Monitoring Recommendations

Centralize access point logs in a SIEM and alert on repeated service crashes within a short time window
Enable switch-level port mirroring on uplink ports feeding critical access points for retrospective analysis
Track Layer 2 neighbor changes on access point uplink VLANs to identify unauthorized hosts
Review wireless controller event streams for unexpected access point disconnections correlated with network events

How to Mitigate CVE-2026-102167

Immediate Actions Required

Apply the fixed firmware versions documented in Arista Security Advisory #0197 as soon as deployment windows permit
Inventory all Arista Wi-Fi access points and identify those running vulnerable firmware
Restrict Layer 2 access to the access point wired uplink segment to trusted infrastructure devices only
Verify logging from access points is reaching a central collector so exploitation attempts are visible

Patch Information

Arista has published remediation guidance in Security Advisory #0197. Consult the advisory for the complete list of affected products, fixed software trains, and version-specific upgrade paths. Apply the vendor-recommended firmware upgrade to eliminate the vulnerable code path.

Workarounds

Place access point wired uplink ports on an isolated management VLAN that is not shared with user traffic
Apply switch access control lists on uplink ports to permit only required management protocols from the wireless controller or management hosts
Enable Layer 2 protections such as port security and DHCP snooping to reduce the ability of rogue hosts to join the uplink segment
Disable or firewall any non-essential services exposed on the access point uplink interface where the vendor permits such configuration

bash

# Example switch-side hardening for an access point uplink port
interface GigabitEthernet1/0/10
  description AP-Uplink-Restricted
  switchport mode access
  switchport access vlan 50
  switchport port-security
  switchport port-security maximum 1
  switchport port-security violation restrict
  ip access-group AP-MGMT-ONLY in
!
ip access-list extended AP-MGMT-ONLY
  permit ip host 10.10.50.5 any   # Wireless controller
  deny   ip any any log