CVE-2026-102167 in Wi-Fi Access Points
Summary
by MITRE • 10/06/2026
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The identified security flaw resides within the networking stack of Arista Wi-Fi access points, specifically targeting the handling of packets received through the wired uplink interface. This vulnerability is classified as a memory corruption issue, which typically arises from improper management of dynamic memory allocation or buffer boundaries during packet processing. In this specific context, the sensor service responsible for monitoring and managing network traffic fails to adequately validate input data before writing it into allocated memory regions. Consequently, an attacker who crafts maliciously formatted packets can trigger out-of-bounds writes or use-after-free conditions within the device's operating system. This type of flaw is fundamentally categorized under CWE-120 Buffer Overflow without null termination and CWE-787 Out-of-bounds Write in standard vulnerability classification systems, reflecting the core mechanism by which memory integrity is compromised.
The operational impact of this vulnerability is severe due to its potential for remote code execution. While a successful exploit can lead to arbitrary command execution on the access point with the privileges of the affected service, it also presents an immediate risk of denial of service. An unauthenticated attacker capable of reaching the wired uplink interface can send specific trigger packets that cause the sensor service to crash or become unstable. This disruption results in the loss of management capabilities and potential degradation of Wi-Fi connectivity for associated clients until the device is rebooted or the service is restarted by an administrator. The ability to achieve remote code execution allows an attacker to gain a foothold within the corporate network, potentially using the compromised access point as a pivot point to launch further attacks against internal assets.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1046 Network Service Discovery and T1210 Exploitation of Remote Services, as it involves interacting directly with exposed network services without prior authentication. The requirement for the attacker to be on the same network segment as the wired uplink defines a specific lateral movement constraint. This means that while the vulnerability is critical in terms of impact, its exploitability is limited by physical or logical network segmentation. Attackers must already have layer two connectivity to the management interface or the primary data path of the access point, which often implies they are either physically present near the device or have compromised another host on the same local area network segment.
Mitigation strategies should prioritize immediate patching through vendor-provided firmware updates that address the memory handling logic in the sensor service. In scenarios where patches cannot be applied immediately, network segmentation is a critical control measure. Administrators should ensure that the wired uplink interfaces of access points are not exposed to untrusted networks or public-facing segments. Implementing strict firewall rules on upstream switches and routers can restrict traffic destined for these devices to only authorized management subnets. Additionally, enabling port security features such as 802.1X authentication on switch ports connected to the wired uplinks adds an additional layer of defense by ensuring that only authenticated and authorized devices can communicate with the access points, thereby neutralizing the unauthenticated attack vector described in the vulnerability report.