CVE-2026-102169
MediumCVSS 6.5Summary
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. The service restarts automatically, but a sustained low-rate attack can cause persistent denial of service. Remote code execution is not possible.
Risk Assessment
The risk involves persistent unavailability of the Captive Portal, potentially disrupting client authentication and affecting Wi-Fi network availability for users.
Recommendation
Upgrade Arista access point firmware to a patched version and implement HTTP traffic monitoring to detect attacks on the portal.
Other vulnerabilities in Arista Wi-Fi access points
See all- CVE-2026-102168Medium
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. This results in temporary denial of service until the service restarts automatically. Remote code execution is not possible.
- CVE-2026-102167High
Arista Wi-Fi access points contain a memory corruption vulnerability in the wired uplink network endpoints. An unauthenticated attacker on the same network segment can crash the sensor service or potentially achieve remote code execution.
- CVE-2026-102165High
Arista Wi-Fi access points contain a vulnerability in the capture service. An unauthenticated attacker with network access can send a crafted packet to crash the service or potentially achieve remote code execution. This requires an uncommon non-default streaming mode.
- CVE-2026-102162High
Arista Wi-Fi access points with captive portal or application firewall enabled on at least one SSID contain a vulnerability in the wireless gateway service. An unauthenticated network-adjacent attacker can send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device.
Original NVD description (English source)
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS