CVE-2026-102168: Arista Wi-Fi Access Point DOS Vulnerability

CVE-2026-102168 Overview

CVE-2026-102168 is a denial-of-service vulnerability affecting Arista Wi-Fi access points running Captive Portal. An unauthenticated wireless client associated with a Captive-Portal-enabled SSID can send a crafted HTTP request that crashes the portal service. The service automatically restarts, producing a temporary outage of the captive portal functionality. The flaw is categorized as an integer underflow issue [CWE-191]. Remote code execution is not possible according to the vendor advisory.

Critical Impact
An adjacent, unauthenticated attacker can repeatedly crash the Captive Portal service on affected Arista Wi-Fi access points, disrupting guest and onboarding authentication workflows that depend on the portal.

Affected Products

Arista Wi-Fi access points with Captive Portal enabled
Portal service component handling HTTP requests on Captive-Portal-enabled SSIDs
Refer to Arista Security Advisory #0194 for the full list of affected versions

Discovery Timeline

2026-10-06 - CVE-2026-102168 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102168

Vulnerability Analysis

The vulnerability resides in the HTTP request handling logic of the Captive Portal service on Arista Wi-Fi access points. A crafted HTTP request from a wireless client associated with a Captive-Portal-enabled SSID triggers an integer underflow condition. The resulting invalid computation causes the portal process to terminate. The service watchdog restarts the portal, but repeated requests can sustain an outage. Only clients that can associate with the SSID and reach the portal listener can trigger the condition, so the attack vector is adjacent rather than fully remote.

Root Cause

The root cause is classified as an integer underflow or wraparound [CWE-191] in the portal service's HTTP parsing path. When specific fields in the request produce a value below the expected minimum, arithmetic on size or length variables wraps to a very large value or an invalid state. This leads to a fatal error that crashes the process. Full technical specifics are maintained by the vendor in Arista Security Advisory #0194.

Attack Vector

Exploitation requires wireless proximity. An attacker associates with a Captive-Portal-enabled SSID without authentication, which is normal for guest-style portals, then sends the crafted HTTP request to the portal listener. No credentials, user interaction, or elevated privileges are required. The impact is limited to availability of the portal service; confidentiality and integrity are not affected, and code execution is not possible per vendor analysis.

No public proof-of-concept code is available. See the vendor advisory linked above for authoritative technical details.

Detection Methods for CVE-2026-102168

Indicators of Compromise

Repeated restarts or crash log entries for the Captive Portal service on Arista access points
Guest or onboarding clients unable to reach the portal landing page while associated to the SSID
Short-lived HTTP sessions from unauthenticated wireless clients immediately preceding portal service restarts

Detection Strategies

Monitor access point system logs for portal process termination, watchdog restarts, and segmentation fault entries
Alert on anomalous HTTP request patterns to the portal listener from pre-authentication clients, including malformed Content-Length or chunked-encoding fields
Correlate wireless association events with portal service restart events in SIEM to identify adjacent attacker behavior

Monitoring Recommendations

Forward Arista access point syslog and CloudVision telemetry into a central analytics platform for continuous visibility into portal service health
Track baselines for portal uptime and request-rate per SSID, and alert on deviations
Review Wi-Fi client association logs for repeated associations from the same MAC address or randomized MACs targeting portal-enabled SSIDs

How to Mitigate CVE-2026-102168

Immediate Actions Required

Review Arista Security Advisory #0194 and identify affected access point models and software versions in your fleet
Apply the fixed software release provided by Arista as soon as change windows permit
If patching is delayed, consider temporarily disabling Captive Portal on exposed SSIDs or restricting SSID broadcast to lower-risk areas

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0194. Administrators should consult the advisory for the list of fixed releases and upgrade procedures appropriate for their deployment.

Workarounds

Disable Captive Portal on affected SSIDs where guest onboarding is not strictly required
Reduce the attack surface by limiting the physical radio coverage of Captive-Portal-enabled SSIDs
Implement wireless intrusion detection to identify abusive clients and apply MAC-based blocklists at the controller

bash

# Example: disable captive portal on an SSID (consult Arista documentation for exact syntax)
# ssid guest-net
#   no captive-portal
#   exit